GHSA-v6gv-fg46-h89j Sensitive Data Exposure in put
Attackers can read sensitive uninitialized memory data due to incorrect buffer size calculation in the put package on older Node.js versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-v6gv-fg46-h89j?
GHSA-v6gv-fg46-h89j is a vulnerability in put, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of put are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of Node.js <=6.x.
Recommendation
Upgrade your Node.js version or consider using an alternative package.
Which versions are affected by GHSA-v6gv-fg46-h89j?
2 open source packages ship an affected version, including put.
| Package | Affected | Fixed in |
|---|---|---|
put npm | All versions | None |
put npm | All versions | None |
How do I fix GHSA-v6gv-fg46-h89j?
No fix has been published for GHSA-v6gv-fg46-h89j yet. Limit exposure of the affected software until one is available.
Is GHSA-v6gv-fg46-h89j being exploited?
There is no known exploitation of GHSA-v6gv-fg46-h89j in the wild and no public exploit code.