GitHub Advisoryadvisory · npm

GHSA-3wcq-x3mq-6r9p Potential memory exposure in dns-packet

HIGH Published 2021-05-24 Modified 2021-05-26 Official page ↗
Aliases
CVE-2021-23386
Ecosystem
npm
Packages
dns-packet
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Weaknesses
CWE-200, CWE-908
Reviewed
2021-05-21

Affected packages

• npm dns-packet: >= 2.0.0, < 5.2.2 → fixed in 5.2.2 • npm dns-packet: < 1.3.2 → fixed in 1.3.2

Description

This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

Related

Alias · CVE (1)

  • CVE-2021-23386 This affects the package dns-packet before 5.2.2. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-908 Use of Uninitialized Resource weakness

References