GHSA-wrw9-m778-g6mc Memory Exposure in bl
An attacker can read uninitialized memory by triggering buffer appends with numeric inputs in the bl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wrw9-m778-g6mc?
GHSA-wrw9-m778-g6mc is a vulnerability in bl, published on 3 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of bl before 0.9.5 and 1.0.1 are vulnerable to memory exposure.
bl.append(number) in the affected bl versions passes a number to Buffer constructor, appending a chunk of uninitialized memory
Recommendation
Update to version 0.9.5, 1.0.1 or later.
Which versions are affected by GHSA-wrw9-m778-g6mc?
4 open source packages ship an affected version, including bl.
| Package | Affected | Fixed in |
|---|---|---|
bl npm | All versions | 0.9.5 |
bl npm | All versions | 0.9.5 |
bl npm | From 1.0.0 | 1.0.1 |
bl npm | From 1.0.0 | 1.0.1 |
How do I fix GHSA-wrw9-m778-g6mc?
Upgrade bl to a fixed version for your release line: 0.9.5 or 1.0.1.
Is GHSA-wrw9-m778-g6mc being exploited?
There is no known exploitation of GHSA-wrw9-m778-g6mc in the wild and no public exploit code.