CVE-2020-8244
First published: Sun Aug 30 2020(Updated: )
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Guardium Insights | <=2.0.2 | |
| Bufferlist Project Bufferlist | <1.2.3 | |
| Bufferlist Project Bufferlist | >=2.0.0<2.2.1 | |
| Bufferlist Project Bufferlist | >=3.0.0<3.0.1 | |
| Bufferlist Project Bufferlist | >=4.0.0<4.0.3 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-8244?
CVE-2020-8244 is a buffer over-read vulnerability in the bl module of Node.js.
How does CVE-2020-8244 impact IBM Security Guardium Insights?
IBM Security Guardium Insights versions 2.0.2 and earlier are affected by CVE-2020-8244.
How can an attacker exploit CVE-2020-8244?
An attacker can exploit CVE-2020-8244 by supplying user input that can become negative and corrupt the BufferList state to expose uninitialized memory.
What is the severity of CVE-2020-8244?
CVE-2020-8244 has a severity rating of 8.2 (High).
How can CVE-2020-8244 be fixed?
To fix CVE-2020-8244, upgrade to a version of bl module that is not affected, such as versions 4.0.3, 3.0.1, 2.2.1, or 1.2.3.
- agent/references
- agent/weakness
- agent/type
- agent/last-modified-date
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/severity
- agent/author
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/ibm
- canonical/ibm security guardium insights
- version/ibm security guardium insights/2.0.2
- vendor/bufferlist project
- canonical/bufferlist project bufferlist
- version/bufferlist project bufferlist/2.0.0
- version/bufferlist project bufferlist/3.0.0
- version/bufferlist project bufferlist/4.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0