CVE-2024-55565

nanoid: nanoid mishandles non-integer values

Published Dec 9, 2024 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4003-1 node-postcss security update
Debian DLA Debian DLA DLA-4013-1 node-mocha security update
EUVD EUVD EUVD-2024-3491 nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
Github GHSA Github GHSA GHSA-mwcw-c2x4-8c55 Predictable results in nanoid generation when given non-integer values
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00013}

epss

{'score': 0.00015}

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_ai:2.16::el8
cpe:/a:redhat:rhdh:1.5::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhdh:1.3::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.18::el9
Type Values Removed Values Added
First Time appeared Redhat openshift Ai
Redhat rhdh
CPEs cpe:/a:redhat:openshift_ai:2.17::el8
cpe:/a:redhat:rhdh:1.4::el9
Vendors & Products Redhat openshift Ai
Redhat rhdh
Type Values Removed Values Added
First Time appeared Redhat
Redhat acm
Redhat ansible Automation Platform
Redhat discovery
Redhat logging
Redhat multicluster Engine
Redhat openshift
Redhat openshift Data Foundation
Redhat openshift Devspaces
Redhat service Mesh
CPEs cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.12::el9
cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
cpe:/a:redhat:logging:5.9::el9
cpe:/a:redhat:multicluster_engine:2.6::el8
cpe:/a:redhat:multicluster_engine:2.6::el9
cpe:/a:redhat:multicluster_engine:2.7::el8
cpe:/a:redhat:multicluster_engine:2.7::el9
cpe:/a:redhat:openshift:4.17::el9
cpe:/a:redhat:openshift_data_foundation:4.16::el9
cpe:/a:redhat:openshift_data_foundation:4.17::el9
cpe:/a:redhat:openshift_devspaces:3::el9
cpe:/a:redhat:service_mesh:2.5::el8
cpe:/o:redhat:discovery:1.0::el9
Vendors & Products Redhat
Redhat acm
Redhat ansible Automation Platform
Redhat discovery
Redhat logging
Redhat multicluster Engine
Redhat openshift
Redhat openshift Data Foundation
Redhat openshift Devspaces
Redhat service Mesh
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Type Values Removed Values Added
Title nanoid: nanoid mishandles non-integer values
Weaknesses CWE-835
References
Metrics threat_severity

None

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Type Values Removed Values Added
Description nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
References