search

vipinsun / TrustID

Decentralized Identity solution compatible with different Hyperledger platforms.
https://wiki.hyperledger.org/display/fabric
Apache License 2.0
0 stars 0 forks source link

CVE-2022-4904 (High) detected in Golang_Node_Executorv1.0 #70

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2022-4904 - High Severity Vulnerability

Vulnerable Library - Golang_Node_Executorv1.0

Executes Nodejs via GRPC from Golang client.

Library home page: https://github.com/arijitAD/Golang_Node_Executor.git

Found in base branch: master

Vulnerable Source Files (1)

/trustid-sdk/node_modules/grpc/deps/grpc/third_party/cares/cares/ares_init.c

Vulnerability Details

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Publish Date: 2023-03-06

URL: CVE-2022-4904

CVSS 3 Score Details (8.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-02-13

Fix Resolution: cares-1_19_0

Step up your Open Source Security Game with Mend here