PT-2019-19996 · Floody · Floody

Published 2019-06-04 · Updated 2019-06-04

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions floody versions prior to 0.1.1

Description The issue concerns remote memory exposure. In the affected floody versions, the write(number) function passes a number to the Buffer constructor, which appends a chunk of uninitialized memory. This can lead to exposure of sensitive data.

Recommendations Update to version 0.1.1 or later.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

GHSA-3P92-886G-QXPQ

Affected Products

Floody

References · 4

• https://osv.dev/vulnerability/GHSA-3p92-886g-qxpq · Vendor Advisory
• https://github.com/soldair/node-floody/commit/6c44722312131f4ac8a1af40f0f861c85efe01b0 · Note
• https://snyk.io/vuln/npm:floody:20160115 · Note
• https://npmjs.com/advisories/601 · Note