Packages / kerberos / Security

HighVulnerabilityGHSA-m2mx-rfpw-jghvCVE-2020-13110Published 4 Sep 2020

DLL Injection in kerberos

Affected releases · kerberos

  • 0.0.x0.0.1 – 0.0.24No fix on this line yet

0.0.x has no fix yet; the newest fixed line:

npm install kerberos@1.0.0
7.x

  1. Not affected

    7.0.0

    1 release, latest

0.x

  1. Affected

    0.0.1 – 0.0.24

    23 releases

43 stable releases of kerberos, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for kerberos. It is read in your browser and sent nowhere.

What happens

Version of kerberos prior to 1.0.0 are vulnerable to DLL Injection. The package loads DLLs without specifying a full path. This may allow attackers to create a file with the same name in a folder that precedes the intended file in the DLL path search. Doing so would allow attackers to execute arbitrary code in the machine.

Recommendation

Upgrade to version 1.0.0 or later.