CVE-2018-3739
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory lea...
Résumé
Denial of Service in https-proxy-agent
Description d'origine
La description telle que publiée par la source (souvent en anglais).
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
npm
https-proxy-agent
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- report hackerone.com
- web github.com
- web npmjs.com