Arch Linux Security Advisory ASA-202107-36

Severity: Medium
Date : 2021-07-20
CVE-ID : CVE-2021-22918
Package : libuv
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-2131

Summary

The package libuv before version 1.41.1-1 is vulnerable to information
disclosure.

Resolution

Upgrade to 1.41.1-1.

pacman -Syu “libuv>=1.41.1-1”

The problem has been fixed upstream in version 1.41.1.

Workaround

None.

Description

libuv before version 1.14.1, as bundled by Node.js before versions
16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in
the libuv’s uv__idna_toascii() function which is used to convert
strings to ASCII. This is called by Node’s dns module’s lookup()
function and can lead to information disclosures or crashes.

Impact

Attempting to look up a crafted domain name could disclose sensitive
information or crash an application using libuv.

References

https://github.com/libuv/libuv/issues/3147
https://hackerone.com/reports/1209681
https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de21b9
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv-upgrade-out-of-bounds-read-medium-cve-2021-22918
https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631829
https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac358
https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc096a7
https://security.archlinux.org/CVE-2021-22918