Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2021-22918 →
DEBIAN-CVE-2021-22918
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointe...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
libuv1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-2"}]}]
Debian:13
libuv1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-2"}]}]
Debian:14
libuv1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-2"}]}]
Références
- advisory security-tracker.debian.org