GitHub Advisoryadvisory · npm

GHSA-pp7h-53gx-mx7r Remote Memory Exposure in bl

MEDIUM Published 2020-09-02 Modified 2022-05-26 Official page ↗
Aliases
CVE-2020-8244
Ecosystem
npm
Packages
bl
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weaknesses
CWE-125, CWE-126
Reviewed
2020-09-02

Affected packages

• npm bl: < 1.2.3 → fixed in 1.2.3 • npm bl: >= 2.0.0, < 2.2.1 → fixed in 2.2.1 • npm bl: >= 3.0.0, < 3.0.1 → fixed in 3.0.1 • npm bl: >= 4.0.0, < 4.0.3 → fixed in 4.0.3

Description

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Related

Alias · CVE (1)

  • CVE-2020-8244 A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even… vulnerability

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-126 Buffer Over-read weakness

References