CVE-2018-3737

Regular Expression Denial of Service in sshpk

Description

Versions of sshpk before 1.13.2 or 1.14.1 are vulnerable to regular expression denial of service when parsing crafted invalid public keys.

Recommendation

Update to version 1.13.2, 1.14.1 or later.

Patch Available

Fix available through Seal Security.  
No upgrade required, protect your application instantly.

Fix without upgrading

Score

Severity

Ecosystem

JavaScript

Publish Date

August 15, 2018

Modified Date

November 7, 2023

Score Vector

Affected Versions