PT-2018-16162 · Hewlett Packard · Https-Proxy-Agent

Published 2018-06-07 · Updated 2019-10-09 · CVE-2018-3739

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions https-proxy-agent versions prior to 2.2.0

Description The issue results in a denial of service and an uninitialized memory leak due to unsanitized options being passed to the Buffer() function. This can occur when an attacker submits typed input to the auth parameter, such as in JSON setups.

Recommendations Update to version 2.2.0 or later.

Exploit

Fix

Out of bounds Read

Resource Exhaustion

Weakness Enumeration

CWE-125

CWE-400

Related Identifiers

CVE-2018-3739

GHSA-8G7P-74H8-HG48

Affected Products

Https-Proxy-Agent

References · 9

• 🔥 https://hackerone.com/reports/319532 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3736 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3739 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8g7p-74h8-hg48 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3739 · Security Note
• https://github.com/TooTallNate/node-https-proxy-agent/commit/1c24219df87524e6ed973127e81f30801d658f07 · Note
• https://github.com/TooTallNate/node-https-proxy-agent · Note
• https://github.com/advisories/GHSA-8g7p-74h8-hg48 · Note
• https://npmjs.com/advisories/593 · Note