Bug 1576651 (CVE-2018-3736)

Summary:	CVE-2018-3736 nodejs-https-proxy-agent: Unsanitized options passed to Buffer() allow for denial of service
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	dffrench, drusso, hhorak, jmadigan, jorton, jshepherd, lgriffin, lpardo, ngough, nodejs-maint, piotr1212, pwright, rrajasek, sfowler, trepel
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-https-proxy-agent 2.2.0	Doc Type:	If docs needed, set a value
Doc Text:	[REJECTED CVE] A flaw was found in https-proxy-agent, prior to version 2.2.0. It was discovered https-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-07-05 14:16:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1576652, 1576653
Bug Blocks:	1588910

Description Sam Fowler 2018-05-10 04:28:01 UTC

Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().


External References:

https://nodesecurity.io/advisories/593
https://hackerone.com/reports/319532

Comment 1 Sam Fowler 2018-05-10 04:28:12 UTC

Created nodejs-https-proxy-agent tracking bugs for this issue:

Affects: epel-7 [bug 1576652]
Affects: fedora-all [bug 1576653]

Comment 2 Jason Shepherd 2018-06-11 05:48:35 UTC

https-proxy-agent is included in supercore by it's dependency on NPM. It doesn't make use of the vulnerable API in the supercore source code.

Comment 3 Laura Pardo 2019-07-05 14:16:52 UTC

This CVE has been rejected as a duplicate of CVE-2018-3739. See bug 1727312

*** This bug has been marked as a duplicate of bug 1727312 ***

Comment 4 Doran Moppert 2020-02-10 04:33:17 UTC

Statement:

This flaw was found to be a duplicate of CVE-2018-3739. Please see https://access.redhat.com/security/cve/CVE-2018-3739 for information about affected products and security errata.