Node.js ejs Package 'ejs.renderFile()' function Denial of Service Vulnerability

Bugtraq ID:	101893
Class:	Input Validation Error
CVE:	CVE-2017-1000189
Remote:	Yes
Local:	No
Published:	Nov 16 2017 12:00AM
Updated:	Dec 19 2017 10:37PM
Credit:	Snyk Security Research Team
Vulnerable:	mde ejs 2.5.4 mde ejs 2.5.3 mde ejs 2.5.2 mde ejs 2.5.1 mde ejs 2.4.2 mde ejs 2.4.1 mde ejs 2.3.4
Not Vulnerable:	mde ejs 2.5.5

Node.js ejs Package 'ejs.renderFile()' function Denial of Service Vulnerability

The ejs Package for Node.js is prone to a denial-of-service vulnerability

Remote attackers can exploit this issue to cause denial-of-service conditions.

Node.js ejs Package 'ejs.renderFile()' function Denial of Service Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Node.js ejs Package 'ejs.renderFile()' function Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Node.js ejs Package 'ejs.renderFile()' function Denial of Service Vulnerability

References:

• Blacklist a few other unsafe opts from passing in data obj (github)
  
• Denial of Service vulnerabilities (snyk)
  
• ejs home page (ejs)