PT-2018-16160 · Unknown · Https-Proxy-Agent

Published 2018-07-27 · Updated 2018-07-27 · CVE-2018-3736

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions https-proxy-agent versions prior to 2.2.0

Description The issue is related to a denial of service caused by unsanitized options, specifically proxy.auth, being passed to Buffer().

Recommendations Update to version 2.2.0 or later.

Fix

Out of bounds Read

Resource Exhaustion

Weakness Enumeration

CWE-125

CWE-400

Related Identifiers

CVE-2018-3736

GHSA-8G7P-74H8-HG48

Affected Products

Https-Proxy-Agent

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-3736 · Security Note
• https://osv.dev/vulnerability/GHSA-8g7p-74h8-hg48 · Vendor Advisory
• https://github.com/TooTallNate/node-https-proxy-agent · Note
• https://github.com/TooTallNate/node-https-proxy-agent/commit/1c24219df87524e6ed973127e81f30801d658f07 · Note
• https://github.com/advisories/GHSA-8g7p-74h8-hg48 · Note
• https://hackerone.com/reports/319532 · Note
• https://npmjs.com/advisories/593 · Note