CVE-2018-3739 Vulnerability in maven package org.webjars.npm:https-proxy-agent

Description

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).

Remediation

References

https://hackerone.com/reports/319532

Related Vulnerabilities

CVE-2017-16006 Vulnerability in maven package org.webjars.bower:remarkable

CVE-2022-41915 Vulnerability in maven package io.netty:netty-codec

CVE-2020-28446 Vulnerability in npm package ntesseract

CVE-2021-32659 Vulnerability in npm package matrix-appservice-bridge

CVE-2020-28279 Vulnerability in npm package flattenizer

Severity

Critical

Classification

CWE-125 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H