CVE-2018-3739 Denial of Service in https-proxy-agent
Attackers can cause denial of service and leak uninitialized memory by submitting typed input to the auth parameter in https-proxy-agent.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-3739?
CVE-2018-3739 is a critical denial of service vulnerability in HackerOne https-proxy-agent node module, published on 7 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Which versions are affected by CVE-2018-3739?
2 open source packages ship an affected version, including https-proxy-agent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
https-proxy-agent npm | All versions | 2.2.0 |
https-proxy-agent npm | All versions | 2.2.0 |
Products include Https-Proxy-Agent Project Https-Proxy-Agent.
How do I fix CVE-2018-3739?
Upgrade https-proxy-agent to 2.2.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-3739 being exploited?
There is no known exploitation of CVE-2018-3739 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1776904630, CVE-2018-3736, GHSA-8g7p-74h8-hg48.