get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit `f934b228b` which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the     browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos)     vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can     be exploited when there is an imbalance in parentheses, which results in excessive backtracking and     subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered     using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit     `f934b228b` which has been included in releases from 2.0.1. Users are advised to upgrade. There are no     known workarounds for this vulnerability. (CVE-2023-43646)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the
    browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos)
    vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can
    be exploited when there is an imbalance in parentheses, which results in excessive backtracking and
    subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered
    using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit
    `f934b228b` which has been included in releases from 2.0.1. Users are advised to upgrade. There are no
    known workarounds for this vulnerability. (CVE-2023-43646)

ID	Name	Product	Family	Severity
226654	Linux Distros Unpatched Vulnerability : CVE-2023-43646	Nessus	Misc.	high
410336	SCA: security update for get-func-name (GHSA-4q6p-r6v2-jvc5)	Tenable Cloud Security	SCA Checks	high
410336	SCA: security update for get-func-name (GHSA-4q6p-r6v2-jvc5)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2023-43646

high

Tenable Plugins

high

high

high