Bug 1579507

Summary:	nodejs-base64url: Uninitialized Memory Exposure in pad-string.ts
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ahardin, bleanhar, ccoleman, dedgar, jgoulding, jokerman, jsmith.fedora, mchappel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:23:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1579511, 1582592
Bug Blocks:	1579508

Description Laura Pardo 2018-05-17 20:01:59 UTC

A flaw was found in base64url. An Uninitialized Memory Exposure in pad-string.ts file allows an attacker to extract sensitive data from uninitialized memory or may cause a Denial of Service (DoS) by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).On Node.js 4.x and below (4.x is still supported), this exposes uninitialized memory, which could contain sensitive data. This can be also used to cause a DoS by consuming the memory when large numbers are passed on input.


References:
https://snyk.io/vuln/npm:base64url:20180511
https://hackerone.com/reports/321687

Patch:
https://github.com/brianloveswords/base64url/commit/4355cb294123e86171daa9389f7afe6d2b2b9dae

Comment 1 Laura Pardo 2018-05-17 20:12:00 UTC

Created nodejs-base64-url tracking bugs for this issue:

Affects: fedora-all [bug 1579511]

Comment 3 Jason Shepherd 2018-06-13 21:31:19 UTC

NodeJS is shipped in Openshift Enterprise 3.9 as ImageStreams. Those ImageStreams are the RH Software Collection images. Setting Openshift Enterprise 3 as not affected.