En bref
- CVE-2018-3739 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant https-proxy-agent (https-proxy-agent project), https-proxy-agent.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.7%, plus élevée que 77.8% des vulnérabilités.
- Correctif : mettre à jour vers 2.2.0 ou plus récent.
Description
Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().
Recommendation
Update to version 2.2.0 or later.
NVD description
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free