Log in Start free

Vulnerability · Published Dec 15, 2023 · Assigned by GitHub_M

CVE-2023-50728Unauthenticated Denial of Service in the octokit/webhooks library

Medium 5.4

In plain English

A medium-severity security flaw in webhooks.js from octokit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.9%top 40.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases. The resulting request was found to cause an uncaught exception that ends the nodejs process. The bug is fixed in octokit/webhooks.js 9.26.3, 10.9.2, 11.1.2, and 12.0.4, app.js 14.02, octokit.js 3.1.2, and Protobot 12.3.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@octokit/app14.0.2GHSA-pwfr-8pq7-x9qv
npm@octokit/webhooks10.9.2GHSA-pwfr-8pq7-x9qv
npm@octokit/webhooks11.1.2GHSA-pwfr-8pq7-x9qv
npm@octokit/webhooks9.26.3GHSA-pwfr-8pq7-x9qv
npm@octokit/webhooks12.0.3GHSA-pwfr-8pq7-x9qv
npmoctokit3.1.2GHSA-pwfr-8pq7-x9qv
npmprobot12.3.3GHSA-pwfr-8pq7-x9qv

Affected products (as reported)

VendorProductVersions
octokit webhooks.js >= 9.26.0, < 9.26.3>= 10.9.0, < 10.9.2>= 11.1.0, < 11.1.2>= 12.0.0, < 12.0.4

Weakness: CWE-755 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

References