This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.
CPE | Name | Operator | Version |
---|---|---|---|
dns-packet | ge | 2.0.0 | |
dns-packet | lt | 5.2.2 | |
dns-packet | lt | 1.3.2 |
github.com/mafintosh/dns-packet/commit/0d0d593f8df4e2712c43957a6c62e95047f12b2d
github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56
hackerone.com/bugs?subject=user&%3Breport_id=968858
nvd.nist.gov/vuln/detail/CVE-2021-23386
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719
snyk.io/vuln/SNYK-JS-DNSPACKET-1293563