GHSA-3wcq-x3mq-6r9p

Potential memory exposure in dns-packet

At a glance

Published: 2021-05-24 19:51 UTC
Updated: 2025-01-14 08:56 UTC
CVE: CVE-2021-23386
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Description

This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

Affected packages

Package	Versions
npm · dns-packet	introduced 2.0.0, fixed 5.2.2
npm · dns-packet	introduced 0, fixed 1.3.2

References

https://nvd.nist.gov/vuln/detail/CVE-2021-23386 ADVISORY
https://github.com/mafintosh/dns-packet/commit/0d0d593f8df4e2712c43957a6c62e95047f12b2d WEB
https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56 WEB
https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858 WEB
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719 WEB
https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database