GitHub Advisoryadvisory · npm

GHSA-8g7p-74h8-hg48 Denial of Service in https-proxy-agent

CRITICAL Published 2018-07-27 Modified 2021-09-07 Official page ↗

Aliases: CVE-2018-3739
Ecosystem: npm
Packages: https-proxy-agent
Severity: Critical
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses: CWE-125, CWE-400
Reviewed: 2020-06-16

Affected packages

• npm https-proxy-agent: < 2.2.0 → fixed in 2.2.0

Description

Versions of `https-proxy-agent` before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to `Buffer()`. Recommendation Update to version 2.2.0 or later.

Alias · CVE (1)

CVE-2018-3739 https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized… vulnerability

Weakness · CWE (2)

CWE-125 Out-of-bounds Read weakness
CWE-400 Uncontrolled Resource Consumption weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2018-3736 advisory
https://github.com/TooTallNate/node-https-proxy-agent/commit/1c24219df87524e6ed973127e81f30801d658f07 web
https://hackerone.com/reports/319532 web
https://github.com/TooTallNate/node-https-proxy-agent package
https://github.com/advisories/GHSA-8g7p-74h8-hg48 advisory
https://www.npmjs.com/advisories/593 web