CVE-2021-23386: Potential memory exposure in dns-packet
Summary
CVE-2021-23386: Potential memory exposure in dns-packet. Affects dns-packet across 2 version ranges.
< 1.3.2
>= 2.0.0, < 5.2.2
Fixed in 1.3.2 or 5.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dns-packet package is an npm package that provides functionality for encoding and decoding DNS packets. It is commonly used in Node.js applications for DNS-related operations. The package allows users to create DNS packets and send them over the network. However, versions before 1.3.2 and 5.2.2 of dns-packet are vulnerable to a potential memory exposure issue. When crafting invalid domain names, the package creates buffers using the allocUnsafe function without always filling them before forming network packets. This can lead to the exposure of internal application memory over unencrypted networks.
Vulnerability Detail
The vulnerability in dns-packet arises from the improper handling of buffers created with allocUnsafe. By not always filling these buffers before forming network packets, the package exposes internal application memory when querying crafted invalid domain names. This can be exploited by an attacker to obtain sensitive information from the application's memory. The vulnerability has a CVSS score of 7.7, indicating a high severity level. It is important to note that this vulnerability affects versions before 1.3.2 and 5.2.2 of dns-packet.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.21.3.2npm install dns-packet@1.3.2 -
>= 2.0.0, < 5.2.25.2.2npm install dns-packet@5.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if updating the package is not immediately feasible, it is recommended to avoid querying crafted invalid domain names that could trigger the vulnerability. By ensuring that only valid domain names are used in DNS queries, the risk of memory exposure can be mitigated.
Conclusion
In conclusion, the dns-packet package before versions 1.3.2 and 5.2.2 is vulnerable to a potential memory exposure issue. This can lead to the exposure of internal application memory over unencrypted networks when querying crafted invalid domain names. To mitigate this vulnerability, it is recommended to update the package to the latest secure version. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for dns-packet →
FAQ
dns-packet is an npm package used for encoding and decoding DNS packets in Node.js applications.
Versions before 1.3.2 and 5.2.2 of dns-packet are affected by this vulnerability.
The vulnerability can be exploited by crafting invalid domain names and querying them, which can expose internal application memory over unencrypted networks.
The vulnerability has a CVSS score of 7.7, indicating a high severity level.
To fix this vulnerability, update the dns-packet package to version 1.3.2 or later, or version 5.2.2 or later.
