GHSA-mf6x-7mm4-x2g7

Source

https://github.com/advisories/GHSA-mf6x-7mm4-x2g7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-mf6x-7mm4-x2g7/GHSA-mf6x-7mm4-x2g7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mf6x-7mm4-x2g7

Aliases

CVE-2018-21270

Published

2019-06-20T18:22:32Z

Modified

2023-11-08T04:00:14.605779Z

Summary

Out-of-bounds Read in stringstream

Details

All versions of stringstream are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.

Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is being passed in to stringstream.

Database specific

{
    "github_reviewed_at": "2019-06-20T18:22:00Z",
    "cwe_ids": [
        "CWE-125"
    ],
    "nvd_published_at": "2020-12-03T21:15:00Z",
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

npm / stringstream

Package

Name: stringstream; View open source insights on deps.dev
Purl: pkg:npm/stringstream

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.6