Bug 1140751 (CVE-2019-10196) - VUL-0: CVE-2019-10196: nodejs8,nodejs10,nodejs: nodejs-http-proxy-agent: Denial of Service and data leak due to improper buffer sanitization
Summary: VUL-0: CVE-2019-10196: nodejs8,nodejs10,nodejs: nodejs-http-proxy-agent: Deni...
Status: RESOLVED FIXED
Alias: CVE-2019-10196
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Major
Target Milestone: ---
Assignee: Adam Majer
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/236637/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-07-08 15:55 UTC by Marcus Meissner
Modified: 2019-07-08 15:59 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2019-07-08 15:55:41 UTC 
rh#1567245

A flaw was found in http-proxy-agent versions before 2.1.0. The http-proxy-agent passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).


References:
https://hackerone.com/reports/321631

Patch:
https://github.com/TooTallNate/node-http-proxy-agent/commit/b7b7cc793c3226aa83f820ce5c277e81862d32eb

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1567245
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10196
Comment 1 Marcus Meissner 2019-07-08 15:59:54 UTC 
this was fixed already in the previous version update.