Detections
Analytics

SCA: security update for cumulative-distribution-function (GHSA-58qp-5328-v7mh)

high Tenable Self-Hosted Container Security Plugin ID 410696

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - cumulative-distribution-function is an open source npm library used which calculates statistical
 cumulative distribution function from data array of x values. In versions prior to 2.0.0 apps using this
 library on improper data may crash or go into an infinite-loop. In the case of a nodejs server-app using
 this library to act on invalid non-numeric data, the nodejs server may crash. This may affect other users
 of this server and/or require the server to be rebooted for proper operation. In the case of a browser app
 using this library to act on invalid non-numeric data, that browser may crash or lock up. A flaw enabling
 an infinite-loop was discovered in the code for evaluating the cumulative-distribution-function of input
 data. Although the documentation explains that numeric data is required, some users may confuse an array
 of strings like ["1","2","3","4","5"] for numeric data [1,2,3,4,5] when it is in fact string data. An
 infinite loop is possible when the cumulative-distribution-function is evaluated for a given point when
 the input data is string data rather than type `number`. This vulnerability enables an infinite-cpu-loop
 denial-of-service-attack on any app using npm:cumulative-distribution-function v1.0.3 or earlier if the
 attacker can supply malformed data to the library. The vulnerability could also manifest if a data source
 to be analyzed changes data type from Arrays of number (proper) to Arrays of string (invalid, but
 undetected by earlier version of the library). Users should upgrade to at least v2.0.0, or the latest
 version. Tests for several types of invalid data have been created, and version 2.0.0 has been tested to
 reject this invalid data by throwing a `TypeError()` instead of processing it. Developers using this
 library may wish to adjust their app's code slightly to better tolerate or handle this TypeError. Apps
 performing proper numeric data validation before sending data to this library should be mostly unaffected
 by this patch. The vulnerability can be mitigated in older versions by ensuring that only finite numeric
 data of type `Array[number]` or `number` is passed to `cumulative-distribution-function` and its `f(x)`
 function, respectively. (CVE-2021-29486)

See Also

https://github.com/advisories/GHSA-58qp-5328-v7mh

Plugin Details

Severity: High

ID: 410696

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2021-29486

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/4/2021

Vulnerability Publication Date: 4/30/2021

Reference Information

CVE: CVE-2021-29486