Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WS-2018-0076 (Medium) detected in https://source.codeaurora.org/quic/le/platform/external/node/v0.10.44 #72

Open
mend-bolt-for-github bot opened this issue Oct 20, 2020 · 0 comments
Open

WS-2018-0076 (Medium) detected in https://source.codeaurora.org/quic/le/platform/external/node/v0.10.44 #72

mend-bolt-for-github bot opened this issue Oct 20, 2020 · 0 comments
Labels
security vulnerability Security vulnerability detected by WhiteSource

Comments

@mend-bolt-for-github
Copy link

mend-bolt-for-github bot commented Oct 20, 2020 •
edited
Loading

WS-2018-0076 - Medium Severity Vulnerability

Vulnerable Library - https://source.codeaurora.org/quic/le/platform/external/node/v0.10.44

Library home page: https://source.codeaurora.org/quic/le/platform/external/node/

Found in HEAD commit: cf1f1c0344fa01406f61ff7437a72714be39b47e

Vulnerable Source Files (0)

Vulnerability Details

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Publish Date: 2017-03-05

URL: WS-2018-0076

CVSS 3 Score Details (5.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/598

Release Date: 2018-01-27

Fix Resolution: 0.6.0
@mend-bolt-for-github mend-bolt-for-github bot added the security vulnerability Security vulnerability detected by WhiteSource label Oct 20, 2020
@mend-bolt-for-github mend-bolt-for-github bot changed the title WS-2018-0076 (Medium) detected in tunnel-agent-0.4.3.tgz WS-2018-0076 (Medium) detected in https://source.codeaurora.org/quic/le/platform/external/node/v0.10.44 Nov 18, 2020
@gate5 gate5 mentioned this issue Feb 23, 2021
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security vulnerability Security vulnerability detected by WhiteSource
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants