GitHub Advisoryadvisory · npm

GHSA-wrw9-m778-g6mc Memory Exposure in bl

MEDIUM Published 2019-06-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
bl
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2019-06-03

Affected packages

• npm bl: < 0.9.5 → fixed in 0.9.5 • npm bl: >= 1.0.0, < 1.0.1 → fixed in 1.0.1

Description

Versions of `bl` before 0.9.5 and 1.0.1 are vulnerable to memory exposure. `bl.append(number)` in the affected `bl` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory Recommendation Update to version 0.9.5, 1.0.1 or later.

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References