Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-3G92-W8C5-73PQ
HistoryJul 09, 2024 - 1:32 p.m.

Undici vulnerable to data leak when using response.arrayBuffer()

2024-07-0913:32:30
CWE-201
GitHub Advisory Database
github.com
8
undici
data leak
vulnerability
patched
v6.19.2
node.js
fetch()
arraybuffer()
memory
process conditions.

CVSS3

2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

High

JSON

Impact

Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.

Patches

This has been patched in v6.19.2.

Workarounds

There are no known workaround.

References

https://github.com/nodejs/undici/issues/3337
https://github.com/nodejs/undici/issues/3328
https://github.com/nodejs/undici/pull/3338
https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36

Affected configurations

Vulners
Node
undiciRange<6.19.2
VendorProductVersionCPE
*undici*cpe:2.3:a:*:undici:*:*:*:*:*:*:*:*

Related

cvelist 1
ibm 1
osv 2
nessus 1
debiancve 1
veracode 1
vulnrichment 1
nvd 1
ubuntucve 1
cve 1
cvelist
cvelist
CVE-2024-38372 Undici vulnerable to data leak when using response.arrayBuffer()
2024-07-08 20:25:59
ibm
ibm
Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run Designer Flows containing event nodes are vulnerable to loss of confidentiality [CVE-2024-38372]
2024-08-01 15:04:06
osv
osv
Undici vulnerable to data leak when using response.arrayBuffer()
2024-07-09 13:32:30
CVE-2024-38372
2024-07-08 21:15:12
nessus
nessus
Node.js Module Undici < 6.19.2 Information Disclosure
2024-07-26 00:00:00
debiancve
debiancve
CVE-2024-38372
2024-07-08 21:15:12
veracode
veracode
Memory Disclosure
2024-07-09 05:51:54
vulnrichment
vulnrichment
CVE-2024-38372 Undici vulnerable to data leak when using response.arrayBuffer()
2024-07-08 20:25:59
nvd
nvd
CVE-2024-38372
2024-07-08 21:15:12
ubuntucve
ubuntucve
CVE-2024-38372
2024-07-08 00:00:00
cve
cve
CVE-2024-38372
2024-07-08 21:15:12

CVSS3

2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

High

JSON
Related for GHSA-3G92-W8C5-73PQ
cvelist1ibm1osv2nessus1debiancve1veracode1vulnrichment1nvd1ubuntucve1cve1