PT-2021-22393 · Ced · Ced

Published 2021-08-17 · Updated 2021-08-27 · CVE-2021-39131

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ced versions 0.1.0

Description The issue arises when passing data types other than Buffer to ced, causing the Node.js process to crash. This problem has been resolved in version 1.0.0. As a temporary measure, users can verify if an object is a Buffer using Buffer.isBuffer(obj) before passing it to ced.

Recommendations For ced version 0.1.0, upgrade to version 1.0.0 to resolve the issue. As a temporary workaround, before passing an argument to ced, verify it’s a Buffer using Buffer.isBuffer(obj).

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-241

CWE-755

Related Identifiers

CVE-2021-39131

GHSA-27WQ-QX3Q-FXM9

Affected Products

Ced

References · 10

• 🔥 https://github.com/sonicdoe/ced/security/advisories/GHSA-27wq-qx3q-fxm9 · Exploit
• https://github.com/sonicdoe/ced/commit/a4d9f10b6bf1cd468d1a5b9a283cdf437f8bb7b3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39131 · Security Note
• https://osv.dev/vulnerability/GHSA-27wq-qx3q-fxm9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39131 · Vendor Advisory
• https://github.com/sonicdoe/ced/releases/tag/v1.0.0 · Note
• https://github.com/sonicdoe/ced · Note
• https://t.me/cvenotify/19566 · Telegram Post
• https://t.me/cvenotify/20252 · Telegram Post
• https://t.me/cibsecurity/27467 · Telegram Post