PT-2018-16162 · Hewlett Packard · Https-Proxy-Agent

Publicado 2018-06-07 · Atualizado 2019-10-09 · CVE-2018-3739

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions https-proxy-agent versions prior to 2.2.0

Description The issue results in a denial of service and an uninitialized memory leak due to unsanitized options being passed to the Buffer() function. This can occur when an attacker submits typed input to the auth parameter, such as in JSON setups.

Recommendations Update to version 2.2.0 or later.

Exploit

Correção

Out of bounds Read

Resource Exhaustion

Enumeração de Fraquezas

CWE-125

CWE-400

Identificadores relacionados

CVE-2018-3739

GHSA-8G7P-74H8-HG48

Produtos afetados

Https-Proxy-Agent

Referências · 9

• 🔥 https://hackerone.com/reports/319532 · Exploit
• https://github.com/TooTallNate/node-https-proxy-agent/commit/1c24219df87524e6ed973127e81f30801d658f07 · Nota
• https://github.com/TooTallNate/node-https-proxy-agent · Nota
• https://github.com/advisories/GHSA-8g7p-74h8-hg48 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3736 · Nota de Segurança
• https://npmjs.com/advisories/593 · Nota
• https://osv.dev/vulnerability/CVE-2018-3739 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8g7p-74h8-hg48 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-3739 · Nota de Segurança