Lucene search

[email protected]CVE-2018-3739

HistoryJun 07, 2018 - 2:29 a.m.

CVE-2018-3739

2018-06-0702:29:08

CWE-400

CWE-125

[email protected]

web.nvd.nist.gov

nvd

cve-2018-3739

security

dos

uninitialized memory

json

vulnerability

https-proxy-agent

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

8.9 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.7%

JSON

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the ‘auth’ parameter (e.g. JSON).

Affected configurations

NVD

Node

https-proxy-agent_projecthttps-proxy-agentRange<2.2.0node.js

CPENameOperatorVersion
https-proxy-agent_project:https-proxy-agenthttps-proxy-agent project https-proxy-agentlt2.2.0

CPE	Name	Operator	Version
https-proxy-agent_project:https-proxy-agent	https-proxy-agent project https-proxy-agent	lt	2.2.0

CNA Affected

[
  {
    "product": "https-proxy-agent node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "Versions before 2.1.1"
      }
    ]
  }
]