CVE-2021-23386

Опубликовано: 20 мая 2021

Источник: nvd

CVSS3: 7.7

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

Ссылки

https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56
Patch
Third Party Advisory
https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858
Permissions Required
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563
Patch
Third Party Advisory
https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56
Patch
Third Party Advisory
https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858
Permissions Required
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:dns-packet_project:dns-packet:*:*:*:*:*:node.js:*:*

Версия до 1.3.4 (исключая)

cpe:2.3:a:dns-packet_project:dns-packet:*:*:*:*:*:node.js:*:*

Версия от 2.0.0 (включая) до 5.2.2 (исключая)

EPSS

Процентиль: 78%

0.01115

Низкий

7.7 High

CVSS3

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-909

Связанные уязвимости

CVE-2021-23386

CVSS3: 6.3

redhat

больше 4 лет назад

GHSA-3wcq-x3mq-6r9p

CVSS3: 7.7

github

больше 4 лет назад

Potential memory exposure in dns-packet

EPSS

Процентиль: 78%

0.01115

Низкий

7.7 High

CVSS3

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-909