Vulnerability Details : CVE-2022-25852
Potential exploit
All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq.
Vulnerability category: Denial of service
Products affected by CVE-2022-25852
- cpe:2.3:a:pg-native_project:pg-native:*:*:*:*:*:node.js:*:*
- cpe:2.3:a:libpq_project:libpq:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-25852
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 23 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-25852
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
Snyk |
CWE ids for CVE-2022-25852
-
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.Assigned by: nvd@nist.gov (Primary)
-
The product does not correctly convert an object, resource, or structure from one type to a different type.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-25852
-
https://snyk.io/vuln/SNYK-JS-LIBPQ-2392366
Denial of Service (DoS) in libpq | CVE-2022-25852 | SnykExploit;Third Party Advisory
-
https://snyk.io/vuln/SNYK-JS-PGNATIVE-2392365
Denial of Service (DoS) in pg-native | CVE-2022-25852 | SnykExploit;Third Party Advisory
Jump to