CVE-2019-10196
First published: Fri Apr 13 2018(Updated: )
A flaw was found in http-proxy-agent versions before 2.1.0. The http-proxy-agent passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON). References: <a href="https://hackerone.com/reports/321631">https://hackerone.com/reports/321631</a> Patch: <a href="https://github.com/TooTallNate/node-http-proxy-agent/commit/b7b7cc793c3226aa83f820ce5c277e81862d32eb">https://github.com/TooTallNate/node-http-proxy-agent/commit/b7b7cc793c3226aa83f820ce5c277e81862d32eb</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/nodejs-http-proxy-agent | <2.1.0 | 2.1.0 |
| Http-proxy-agent Project Http-proxy-agent | <2.1.0 | |
| Fedoraproject Fedora | =27 | |
| Redhat Software Collections | ||
| Redhat Enterprise Linux | =7.0 | |
| <=10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://hackerone.com/reports/321631
- https://github.com/TooTallNate/node-http-proxy-agent/commit/b7b7cc793c3226aa83f820ce5c277e81862d32eb
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1567247
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1567246
- https://access.redhat.com/security/cve/CVE-2018-3739
- https://www.npmjs.com/advisories/607
- https://access.redhat.com/support/policy/updates/rhmap
- https://bugzilla.redhat.com/show_bug.cgi?id=1567245
- https://exchange.xforce.ibmcloud.com/vulnerabilities/198865
- https://www.ibm.com/support/pages/node/7057377 (Advisory)
Frequently Asked Questions
What is CVE-2019-10196?
CVE-2019-10196 is a vulnerability in the Node.js http-proxy-agent module that can result in a denial of service and data exposure.
What is the severity of CVE-2019-10196?
CVE-2019-10196 has a critical severity rating of 9.8 out of 10.
How does CVE-2019-10196 affect the affected software?
CVE-2019-10196 affects the Node.js http-proxy-agent module version up to 2.1.0, Fedora 27, Redhat Software Collections, and Redhat Enterprise Linux 7.0.
How can CVE-2019-10196 be exploited?
CVE-2019-10196 can be exploited by passing a specially crafted auth option to the Buffer constructor, leading to a denial of service and potential data exposure.
How can I fix CVE-2019-10196?
To fix CVE-2019-10196, upgrade to http-proxy-agent version 2.1.0 or later.
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- agent/author
- agent/severity
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-10196
- agent/last-modified-date
- agent/tags
- agent/event
- vendor/http-proxy-agent project
- canonical/http-proxy-agent project http-proxy-agent
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/27
- vendor/redhat
- canonical/redhat software collections
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0
- vendor/ibm
- canonical/ibm security verify governance
- version/ibm security verify governance/10.0
- package-manager/redhat