0.8.18-p11 (0.8.18-p12), 3scale-cm (0.7.2) +2356 more potentially affected by CVE-2018-3739 via https-proxy-agent (>=0.3.6, <=2.1.1)

https-proxy-agent NPM version =0.3.6, =0.0.1, =1.0.1, =0.0.1, =0.1.0, =0.1.0, =1.0.0, =0.1.5, =0.0.1, =0.0.1, =0.7.0, =1.0.0, =1.4.0 and more Source cves: CVE-2018-3739 Source advisory: MEND:CVE-2018-3739...

CVE-2018-3739

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter e.g. JSON...

CVE-2018-3739: Uncontrolled Resource Consumption

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter e.g. JSON...

PT-2018-16162

Name of the Vulnerable Software and Affected Versions https-proxy-agent versions prior to 2.2.0 Description The issue results in a denial of service and an uninitialized memory leak due to unsanitized options being passed to the Buffer function. This can occur when an attacker submits typed input...

Denial of Service

Overview Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options proxy.auth being passed to Buffer. Recommendation Update to version 2.2.0 or later. References - index.js Line 207 - HackerOne Report - GitHub Advisory...

Node.js third-party modules: `https-proxy-agent` passes unsanitized options to Buffer(arg), resulting in DoS and uninitialized memory leak

I would like to report a Buffer allocation vulnerability in https-proxy-agent. In setups where auth argument is user-controlled, it allows to: 1. cause Denial of Service by trivially consuming all the available CPU resources 2. extract uninitialized memory chunks from the server on Node.js This...