GHSA-57cf-349j-352g

Source

https://github.com/advisories/GHSA-57cf-349j-352g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-57cf-349j-352g/GHSA-57cf-349j-352g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-57cf-349j-352g

Published

2019-06-12T16:37:00Z

Modified

2020-08-31T18:31:27Z

Summary

Out-of-bounds Read in npmconf

Details

Versions of npmconf before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.

Recommendation

Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.

Database specific

{
    "cwe_ids": [
        "CWE-125"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-06-12T16:35:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

npm / npmconf

Package

Name: npmconf; View open source insights on deps.dev
Purl: pkg:npm/npmconf

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.1.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-57cf-349j-352g/GHSA-57cf-349j-352g.json"