GHSA-3w8q-xq97-5j7x
Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.mozilla:rhino | < 1.7.14.1 | 1.7.14.1 |
| Maven | org.mozilla:rhino | >= 1.7.15, < 1.7.15.1 | 1.7.15.1 |
| Maven | org.mozilla:rhino | >= 1.8.0, < 1.8.1 | 1.8.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
When an application passed an attacker controlled float poing number into the `toFixed()` function, it might lead to high CPU consumption and a potential Denial of Service.
Small numbers go through this call stack: `NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult`
where `pow5mult` attempts to raise `5` to a ridiculous power.
Example code: `(4.47118444E-314).toFixed(2)`
References
External links from the advisory. They lead to third-party sites.