CVE-2018-3745: Out-of-bounds Read in atob
Summary
CVE-2018-3745: Out-of-bounds Read in atob. Affects atob versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'atob' package is an npm package used for decoding base64 encoded strings. It is commonly used in Node.js applications for various purposes. This vulnerability affects versions of 'atob' before 2.1.0 on Node.js 4.x and below. The package fails to handle uninitialized Buffers when a number is passed as input, leading to an out-of-bounds read vulnerability.
Vulnerability Detail
The vulnerability in 'atob' allows an attacker to read data from uninitialized Buffers, potentially leading to information disclosure or crashes in the affected application. This can be exploited by passing a number as input to the 'atob' function. The impact of this vulnerability is considered critical, with a CVSS score of 9.1.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
npm install atob@2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, updating the 'atob' package to the latest version will address the issue.
Conclusion
The 'atob' package before version 2.1.0 on Node.js 4.x and below is vulnerable to an out-of-bounds read issue. This can be fixed by updating the package to the latest version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for atob →
FAQ
This vulnerability allows an attacker to read data from uninitialized Buffers, potentially leading to information disclosure or crashes in the affected application.
Versions of 'atob' before 2.1.0 on Node.js 4.x and below are affected.
To fix this vulnerability, update the 'atob' package to version 2.1.0 or later.
There is no specific workaround mentioned for this vulnerability. Updating the 'atob' package to the latest version is the recommended solution.
The CVSS score of this vulnerability is 9.1, indicating a critical impact.
