title: Duktape 2.6 bug crashes JavaScript putting too many values in valstack.
description: Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
problem types: CWE-129 Improper Validation of Array Index
affected:
{
defaultStatus: affected
modules: [Proxy, Server]
product: Zabbix
repo: https://git.zabbix.com/
vendor: Zabbix
versions:
changes: [at: 5.0.35rc1, status: unaffected], lessThanOrEqual: 5.0.34, status: affected, version: 5,0,0, versionType: git
changes: [at: 6.0.18rc1, status: unaffected], lessThanOrEqual: 6.0.17, status: affected, version: 6,0,0, versionType: git
changes: [at: 6.4.3rc1, status: unaffected], lessThanOrEqual: 6.4.2, status: affected, version: 6.4.0, versionType: git
changes: [at: 7.0.0alpha1, status: unaffected], lessThanOrEqual: 7.0.0alpha1 , status: affected, version: 7.0.0alpha1, versionType: git
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL