PT-2019-20069 · Centra · Centra

Published 2019-09-30 · Updated 2019-09-30

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Centra versions prior to 2.4.0

Description The issue affects Centra when not in stream mode, causing it to buffer responses to requests into memory with no size limit. This impacts anyone requesting content from untrusted sources.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 to resolve the issue by limiting the size of buffered response body. As a temporary workaround is not recommended, updating to the fixed version is the preferred solution.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

GHSA-V6CJ-R88P-92RM

Affected Products

Centra

References · 5

• https://osv.dev/vulnerability/GHSA-v6cj-r88p-92rm · Vendor Advisory
• https://github.com/ethanent/centra · Note
• https://github.com/ethanent/centra/security/advisories/GHSA-v6cj-r88p-92rm · Note
• https://github.com/advisories/GHSA-v6cj-r88p-92rm · Note
• https://snyk.io/vuln/SNYK-JS-CENTRA-536073 · Note