Description

This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

Remediation

References

https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56

https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719

https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563

Related Vulnerabilities

CVE-2020-35490 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2020-26939 Vulnerability in maven package org.bouncycastle:bcprov-ext-jdk14

CVE-2021-30638 Vulnerability in maven package org.apache.tapestry:tapestry-core

CVE-2023-24057 Vulnerability in maven package ca.uhn.hapi.fhir:org.hl7.fhir.convertors

CVE-2020-9548 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

Severity

High

Classification

CWE-909 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Third Party Advisory Permissions Required