Buffer Overflow in centra
Summary
GHSA-v6cj-r88p-92rm: Buffer Overflow in centra. Affects centra versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Centra is an npm package that provides a simple and convenient way to make HTTP requests. It is widely used for fetching content from various sources. However, certain versions of Centra are vulnerable to a buffer overflow issue. This vulnerability allows an attacker to send a specially crafted request that can cause a denial of service (DoS) condition. The affected versions of Centra do not limit the size of buffered response bodies, which can lead to excessive memory consumption when processing large or malicious responses.
Vulnerability Detail
The buffer overflow vulnerability in Centra arises from the lack of size limitation on buffered response bodies. When not in stream mode, Centra buffers the entire response into memory, which can be exploited by an attacker to exhaust system resources. This vulnerability poses a significant risk to anyone requesting content from untrusted sources, as an attacker can send a large or malicious response to consume excessive memory and cause a DoS condition. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-119.
How To Fix
Minimum fixed version
2.4.0
This is the first release that contains the fix.
npm install centra@2.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no recommended workarounds for this vulnerability. It is strongly advised to update Centra to the latest version instead of attempting any workarounds.
Conclusion
The buffer overflow vulnerability in Centra can have severe consequences, leading to a denial of service condition. It is crucial to update Centra to version 2.4.0 or later to mitigate this vulnerability. By limiting the size of buffered response bodies, the latest version prevents excessive memory consumption and ensures the secure usage of Centra. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for centra →
FAQ
The buffer overflow vulnerability in Centra can lead to a denial of service (DoS) condition. An attacker can send a specially crafted request with a large or malicious response, causing excessive memory consumption and potentially crashing the system.
Anyone using an affected version of Centra and requesting content from untrusted sources is vulnerable to this issue.
There are no known exploits for this vulnerability at the time of this advisory. However, it is important to update Centra to the latest version to mitigate the risk.
No, it is strongly recommended to update Centra to the latest version as there are no reliable workarounds for this vulnerability.
For more information, you can refer to the advisory in the GitHub repository of ethanent/centra. If you have any specific questions or comments, you can open an issue in the repository.
