Description

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).

Remediation

References

https://hackerone.com/reports/319532

Related Vulnerabilities

CVE-2023-44487 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2022-25898 Vulnerability in maven package org.webjars.npm:jsrsasign

CVE-2021-3780 Vulnerability in npm package peertube

CVE-2021-25930 Vulnerability in maven package org.opennms:opennms-webapp

CVE-2021-43306 Vulnerability in maven package org.webjars.bowergithub.jquery-validation:jquery-validation

Severity

Critical

Classification

CWE-125 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Tags

Exploit Third Party Advisory