PT-2023-32989 · Bignum+1 · Bignum+1
Publicado
2023-05-24
·
Atualizado
2023-05-24
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
Name of the Vulnerable Software and Affected Versions
bignum versions 0.12.2 through 0.13.0
Description
The issue concerns the use of node-pre-gyp to download pre-built binary versions of the addon. These binaries were previously hosted on an S3 bucket that has since expired and been claimed by a malicious third party. This malicious party is now serving binaries containing malware, which can exfiltrate data from the user's computer.
Recommendations
For bignum versions 0.12.2 through 0.13.0, update to version 0.13.1, which does not use node-pre-gyp and avoids the risk of malicious downloads by not supporting pre-built binary downloads.
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Bignum
Node-Pre-Gyp