CVE-2017-16100

Description

Affected versions of `dns-sync` have an arbitrary command execution vulnerability in the `resolve()` method. ## Recommendation - Use an alternative dns resolver - Do not allow untrusted input into `dns-sync.resolve()`

How to fix CVE-2017-16100

To remediate CVE-2017-16100, upgrade the affected package to a fixed version below.

• npm/dns-sync—upgrade to 0.1.1 or later

Is CVE-2017-16100 being exploited?

Moderate — EPSS is 5.3%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (1)

• from 0, < 0.1.1

References (9)

• ADVISORYgithub.com/advisories/GHSA-jcw8-r9xm-32c6
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-16100
• WEBgithub.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d
• WEBgithub.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d)))