Bug 1577732

Summary:	nodejs-tunnel-agent: Disclosure of unintialized memory when numeric values passed to auth param
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ahardin, bleanhar, ccoleman, dedgar, dffrench, drusso, hhorak, jgoulding, jmadigan, jokerman, jorton, jshepherd, lgriffin, mchappel, ngough, nodejs-sig, piotr1212, pwright, rhel8-maint, rrajasek, tchollingsworth, thrcka, trepel, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-tunnel-agent 0.6.0	Doc Type:	If docs needed, set a value
Doc Text:	It was found that tunnel-agent did not properly handle a numerical value given as the proxy authentication parameter. A malicious user able to control the authentication value could disclose client memory to the proxy server.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:22:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1577733, 1577734, 1577735, 1579712, 1579713
Bug Blocks:	1577736

Description Sam Fowler 2018-05-14 04:27:24 UTC

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.


External References:

https://nodesecurity.io/advisories/598


Upstream commit:

https://github.com/request/tunnel-agent/commit/9ca95ec7219daface8a6fc2674000653de0922c0

Comment 1 Sam Fowler 2018-05-14 04:27:56 UTC

Created nodejs-tunnel-agent tracking bugs for this issue:

Affects: epel-all [bug 1577734]
Affects: fedora-all [bug 1577735]

Comment 5 Jason Shepherd 2018-05-20 23:11:43 UTC

NodeJS is only included as an imagestream in Openshift Enterprise 3.9. The image is being published by RH Software Collections, so we'll pick up a future release when that becomes available.

Comment 6 Jason Shepherd 2018-05-20 23:40:23 UTC

RHMAP 4.6 uses NodeJS 6 (6-18) image from RH Software Collections for all it's NodeJS images. Because this is a low impact flaw setting to WONTFIX.