[ASA-202107-36] libuv: information disclosure

🗓️ 20 Jul 2021 00:00:00Reported by ArchLinuxType

archlinux

archlinux🔗 security.archlinux.org👁 136 Views

libuv:out-of-bounds read vulnerability in uv__idna_toascii() functio

Reporter	Title	Published	Views	Family All 234
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud Pak for Automation	2 Oct 202100:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021	30 Sep 202115:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM App Connect Enterprise v11 & v12 (CVE-2021-22918 and CVE-2021-22921)	1 Oct 202111:17	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-23362, CVE-2021-22918)	22 Apr 202214:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple security vulnerabilities due to its use of NodeJS (CVE-2021-22918, CVE-2021-22960, CVE-2021-22959)	15 Jul 202215:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities	15 Oct 202113:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to denial of service due to CVE-2021-22918	20 Oct 202110:08	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services	9 Nov 202118:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Arch Linux	–	any	libuv	1.41.1-1	libuv-1.41.1-1-any.pkg.tar.zst

Source	Link
security	www.security.archlinux.org/AVG-2131
github	www.github.com/libuv/libuv/issues/3147
hackerone	www.hackerone.com/reports/1209681
github	www.github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de21b9
nodejs	www.nodejs.org/en/blog/vulnerability/july-2021-security-releases/
github	www.github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631829
github	www.github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac358
github	www.github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc096a7
security	www.security.archlinux.org/CVE-2021-22918

20 Jul 2021 00:00Current

0.2Low risk

Vulners AI Score0.2

CVSS 25

CVSS 3.15.3

EPSS0.00718

libuv out-of-bounds read vulnerability uv__idna_toascii()function information disclosure node.js dns module lookup()sensitivity crashes