GoogleOSV:GHSA-3G92-W8C5-73PQUndici vulnerable to data leak when using response.arrayBuffer()
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
AI Score
Confidence
High
Impact
Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.
Patches
This has been patched in v6.19.2.
Workarounds
There are no known workaround.
References
https://github.com/nodejs/undici/issues/3337
https://github.com/nodejs/undici/issues/3328
https://github.com/nodejs/undici/pull/3338
https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36
References
github.com/nodejs/undici
github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36
github.com/nodejs/undici/issues/3328
github.com/nodejs/undici/issues/3337
github.com/nodejs/undici/pull/3338
github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq
nvd.nist.gov/vuln/detail/CVE-2024-38372
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
AI Score
Confidence
High