PT-2018-16160 · Unknown · Https-Proxy-Agent

Publicado 2018-07-27 · Atualizado 2018-07-27 · CVE-2018-3736

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions https-proxy-agent versions prior to 2.2.0

Description The issue is related to a denial of service caused by unsanitized options, specifically proxy.auth, being passed to Buffer().

Recommendations Update to version 2.2.0 or later.

Correção

Out of bounds Read

Resource Exhaustion

Enumeração de Fraquezas

CWE-125

CWE-400

Identificadores relacionados

CVE-2018-3736

GHSA-8G7P-74H8-HG48

Produtos afetados

Https-Proxy-Agent

Referências · 7

• https://github.com/TooTallNate/node-https-proxy-agent · Nota
• https://github.com/TooTallNate/node-https-proxy-agent/commit/1c24219df87524e6ed973127e81f30801d658f07 · Nota
• https://github.com/advisories/GHSA-8g7p-74h8-hg48 · Nota
• https://hackerone.com/reports/319532 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3736 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8g7p-74h8-hg48 · Aviso do Fabricante
• https://npmjs.com/advisories/593 · Nota