PT-2018-6057 · Npm · Request

Github-Actionsbot · Publicado 2018-06-04 · Atualizado 2026-02-04 · CVE-2017-16026

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Request versions 2.2.6 through 2.46.9 Request versions 2.51.0 through 2.67.0

Description: The issue affects the Request library when a multipart request is made and the body type is a number. In such cases, a buffer of the specified size is allocated and sent to the remote server as the body, potentially disclosing local system memory to remote systems.

Recommendations: For Request versions 2.2.6 through 2.46.9, update to version 2.68.0 or later. For Request versions 2.51.0 through 2.67.0, update to version 2.68.0 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-201

Identificadores relacionados

CVE-2017-16026

GHSA-7XFP-9C55-5VQJ

Produtos afetados

Request

Referências · 12

• 🔥 https://github.com/request/request/pull/2018 · Exploit
• 🔥 https://github.com/request/request/issues/1904 · Exploit
• 🔥 https://nodesecurity.io/advisories/309 · Exploit
• https://github.com/request/request/pull/2022 · Nota
• https://github.com/request/request · Nota
• https://github.com/request/request/commit/29d81814bc16bc79cb112b4face8be6fc00061dd · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16026 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16026 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-16026 · Aviso do Fabricante
• https://t.me/aptreports/25683 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-7xfp-9c55-5vqj · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-16026 · Aviso do Fabricante