GHSA-g74r-ffvr-5q9f

Suggest an improvement
Source
https://github.com/advisories/GHSA-g74r-ffvr-5q9f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-g74r-ffvr-5q9f/GHSA-g74r-ffvr-5q9f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-g74r-ffvr-5q9f
Downstream
Published
2019-06-03T17:26:44Z
Modified
2020-08-31T18:29:17Z
Summary
Memory Exposure in concat-stream
Details

Versions of concat-stream before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into write()

Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.

Recommendation

Update to version 1.5.2, 1.4.11, 1.3.2 or later.

If you are unable to update make sure user provided input into the write() function is not a number.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-06-03T17:26:24Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

npm / concat-stream

Package

Name
concat-stream
View open source insights on deps.dev
Purl
pkg:npm/concat-stream

Affected ranges

Type
SEMVER
Events
Introduced
1.5.0
Fixed
1.5.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-g74r-ffvr-5q9f/GHSA-g74r-ffvr-5q9f.json"

npm / concat-stream

Package

Name
concat-stream
View open source insights on deps.dev
Purl
pkg:npm/concat-stream

Affected ranges

Type
SEMVER
Events
Introduced
1.4.0
Fixed
1.4.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-g74r-ffvr-5q9f/GHSA-g74r-ffvr-5q9f.json"

npm / concat-stream

Package

Name
concat-stream
View open source insights on deps.dev
Purl
pkg:npm/concat-stream

Affected ranges

Type
SEMVER
Events
Introduced
1.3.0
Fixed
1.3.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-g74r-ffvr-5q9f/GHSA-g74r-ffvr-5q9f.json"