A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
CVE-2019-10196 - High Severity Vulnerability
An HTTP(s) proxy `http.Agent` implementation for HTTP
Library home page: https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-1.0.0.tgz
Path to dependency file: griffin/ui/angular/package.json
Path to vulnerable library: griffin/ui/angular/node_modules/http-proxy-agent/package.json
Dependency Hierarchy: - typings-2.1.1.tgz (Root Library) - typings-core-2.3.3.tgz - popsicle-proxy-agent-3.0.0.tgz - :x: **http-proxy-agent-1.0.0.tgz** (Vulnerable Library)
A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
Publish Date: 2021-03-19
URL: CVE-2019-10196
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.npmjs.com/advisories/607
Release Date: 2020-07-21
Fix Resolution: 2.1.0