MEDIUM6.5
GHSA-pp7h-53gx-mx7r
Remote Memory Exposure in bl
Quick fix
GHSA-pp7h-53gx-mx7r — bl: upgrade to the fixed version with the command below.
npm install bl@1.2.3Details
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-8244[ADVISORY]
- https://github.com/rvagg/bl/commit/8a8c13c880e2bef519133ea43e0e9b78b5d0c91e[WEB]
- https://github.com/rvagg/bl/commit/d3e240e3b8ba4048d3c76ef5fb9dd1f8872d3190[WEB]
- https://github.com/rvagg/bl/commit/dacc4ac7d5fcd6201bcf26fbd886951be9537466[WEB]
- https://hackerone.com/reports/966347[WEB]
- https://lists.debian.org/debian-lts-announce/2021/06/msg00028.html[WEB]