CVE-2018-21270: Vulnerability in nodejs-stringstream
Summary
CVE-2018-21270: Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x). Affects node-stringstream across 2 version ranges.
< 0.0.6-1
< fbe0be19ebfb422d8fa20ea5204c1713e9214d5f
Fixed in 0.0.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nodejs-stringstream package is a module for Node.js that provides a stream implementation for string data. It allows users to read and write string data as if it were a stream. The package is commonly used in Node.js applications that require stream functionality for string manipulation. However, versions prior to 0.0.6 of the package are vulnerable to an out-of-bounds read leading to uninitialized memory exposure.
Vulnerability Detail
The vulnerability in nodejs-stringstream arises from the allocation of uninitialized buffers when a number is passed in the input stream. This vulnerability affects Node.js 4.x versions. An attacker can exploit this vulnerability to read uninitialized memory, potentially exposing sensitive information. The impact of this vulnerability is considered medium severity.
How To Fix
Minimum fixed version
0.0.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-stringstreamTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
Conclusion
The nodejs-stringstream package prior to version 0.0.6 is vulnerable to an out-of-bounds read leading to uninitialized memory exposure. It is recommended to update the package to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-stringstream →
FAQ
The vulnerability allows an attacker to read uninitialized memory, potentially exposing sensitive information.
Node.js 4.x versions are affected by this vulnerability.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
You can update the package by running the command 'npm install stringstream@0.0.6'.
You can find more information about this vulnerability in the references provided.
Related vulnerabilities
Recent vulnerabilities recorded for node-stringstream.
