CVE-2016-2515 - Vulnerability Details - OpenCVE

ReportizFlow

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Complete

AV:N/AC:L/Au:N/C:N/I:N/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hawk Project	Hawk

Configuration 1 [-]

OR	cpe:2.3:a:hawk_project:hawk:3.1.2:::::::*
	cpe:2.3:a:hawk_project:hawk:4.1.0:::::::*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2016/02/20/1
http://www.openwall.com/lists/oss-security/2016/02/20/2
https://bugzilla.redhat.com/show_bug.cgi?id=1309721
https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa
https://github.com/hueniverse/hawk/issues/168
https://nodesecurity.io/advisories/77
https://nvd.nist.gov/vuln/detail/CVE-2016-2515
https://www.cve.org/CVERecord?id=CVE-2016-2515

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2016-04-13T16:00:00

Updated: 2024-08-05T23:32:20.711Z

Reserved: 2016-02-20T00:00:00

Link: CVE-2016-2515

Vulnrichment

No data.

NVD

Status : Modified

Published: 2016-04-13T16:59:13.473

Modified: 2024-11-21T02:48:36.003

Link: CVE-2016-2515

Redhat

Severity : Low

Publid Date: 2016-01-19T00:00:00Z

Links: CVE-2016-2515 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-01-19T00:00:00", "descriptions": [{"lang": "en", "value": "Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-04-13T15:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hueniverse/hawk/issues/168"}, {"tags": ["x_refsource_MISC"], "url": "https://nodesecurity.io/advisories/77"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"}, {"name": "[oss-security] 20160219 CVE for nodejs hawk", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/02/20/1"}, {"name": "[oss-security] 20160220 Re: CVE for nodejs hawk", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/02/20/2"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2016-2515", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa", "refsource": "CONFIRM", "url": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa"}, {"name": "https://github.com/hueniverse/hawk/issues/168", "refsource": "CONFIRM", "url": "https://github.com/hueniverse/hawk/issues/168"}, {"name": "https://nodesecurity.io/advisories/77", "refsource": "MISC", "url": "https://nodesecurity.io/advisories/77"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"}, {"name": "[oss-security] 20160219 CVE for nodejs hawk", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/02/20/1"}, {"name": "[oss-security] 20160220 Re: CVE for nodejs hawk", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/02/20/2"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:32:20.711Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/hueniverse/hawk/issues/168"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://nodesecurity.io/advisories/77"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"}, {"name": "[oss-security] 20160219 CVE for nodejs hawk", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/02/20/1"}, {"name": "[oss-security] 20160220 Re: CVE for nodejs hawk", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/02/20/2"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2016-2515", "datePublished": "2016-04-13T16:00:00", "dateReserved": "2016-02-20T00:00:00", "dateUpdated": "2024-08-05T23:32:20.711Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hawk_project:hawk:3.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "EC0104C2-41FF-4883-9C80-4819F2A645DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:hawk_project:hawk:4.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "75046180-A750-47A9-AF24-B25A86CA4ABF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression."}, {"lang": "es", "value": "Hawk en versiones anteriores a 3.1.3 y 4.x en versiones anteriores a 4.1.1 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de CPU o interrupci\u00f3n parcial ) a trav\u00e9s de una (1) cabecera o (2) URI larga que coincide contra una expresi\u00f3n regular incorrecta."}], "id": "CVE-2016-2515", "lastModified": "2024-11-21T02:48:36.003", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary"}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2016-04-13T16:59:13.473", "references": [{"source": "[email protected]", "url": "http://www.openwall.com/lists/oss-security/2016/02/20/1"}, {"source": "[email protected]", "url": "http://www.openwall.com/lists/oss-security/2016/02/20/2"}, {"source": "[email protected]", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/hueniverse/hawk/issues/168"}, {"source": "[email protected]", "url": "https://nodesecurity.io/advisories/77"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2016/02/20/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2016/02/20/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/hueniverse/hawk/issues/168"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://nodesecurity.io/advisories/77"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-399"}], "source": "[email protected]", "type": "Primary"}]}