Описание
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.2.0 (исключая)
cpe:2.3:a:https-proxy-agent_project:https-proxy-agent:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 62%
0.00431
Низкий
9.1 Critical
CVSS3
6.4 Medium
CVSS2
Дефекты
CWE-400
CWE-125
Связанные уязвимости
CVSS3: 8.2
redhat
около 8 лет назад
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
EPSS
Процентиль: 62%
0.00431
Низкий
9.1 Critical
CVSS3
6.4 Medium
CVSS2
Дефекты
CWE-400
CWE-125