CVE-2020-8244 Remote Memory Exposure in bl
An attacker can trigger a buffer over-read in the bl library to expose uninitialized memory, potentially leaking sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8244?
CVE-2020-8244 is a medium-severity vulnerability in Debian Debian Linux, published on 30 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Which versions are affected by CVE-2020-8244?
8 open source packages ship an affected version, including bl. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
bl npm | All versions | 1.2.3 |
bl npm | All versions | 1.2.3 |
bl npm | From 2.0.0 | 2.2.1 |
bl npm | From 2.0.0 | 2.2.1 |
bl npm | From 3.0.0 | 3.0.1 |
bl npm | From 3.0.0 | 3.0.1 |
2 more packages
bl npm | From 4.0.0 | 4.0.3 |
bl npm | From 4.0.0 | 4.0.3 |
Products include Bufferlist Project Bufferlist, Debian Debian Linux.
How do I fix CVE-2020-8244?
Upgrade bl to a fixed version for your release line: 1.2.3, 2.2.1, 3.0.1 or 4.0.3.
Is CVE-2020-8244 being exploited?
There is no known exploitation of CVE-2020-8244 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1772756021, CLSA-2026-1774225189, CLSA-2026-1776731791, CLSA-2026-1792491634, DEBIAN-CVE-2020-8244, DLA-2698-1 and 4 more.