PT-2019-20043 · Npm · Concat-Stream

Publicado 2019-06-03 · Atualizado 2019-06-03

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions concat-stream versions prior to 1.5.2

Description The issue arises when user-provided input is passed into the write() function, potentially leading to memory exposure. Versions prior to 1.3.0 are not affected due to not using the unguarded Buffer constructor.

Recommendations Update to version 1.5.2, 1.4.11, or 1.3.2 or later. If you are unable to update, ensure that user-provided input into the write() function is not a number.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

GHSA-G74R-FFVR-5Q9F

Produtos afetados

Concat-Stream

Referências · 5

• https://github.com/maxogden/concat-stream/pull/47 · Nota
• https://github.com/maxogden/concat-stream/pull/47/commits/3e285ba5e5b10b7c98552217f5c1023829efe69e · Nota
• https://npmjs.com/advisories/597 · Nota
• https://osv.dev/vulnerability/GHSA-g74r-ffvr-5q9f · Aviso do Fabricante
• https://gist.github.com/ChALkeR/c2d2fd3f1d72d51ad883df195be03a85 · Nota