A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
CVE-2019-10196 - Critical Severity Vulnerability
An HTTP(s) proxy `http.Agent` implementation for HTTP
Library home page: https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-1.0.0.tgz
Path to dependency file: /vue-scheme/package.json
Path to vulnerable library: /node_modules/http-proxy-agent/package.json
Dependency Hierarchy: - cli-plugin-e2e-nightwatch-3.9.2.tgz (Root Library) - nightwatch-0.9.21.tgz - proxy-agent-2.0.0.tgz - :x: **http-proxy-agent-1.0.0.tgz** (Vulnerable Library)
Found in HEAD commit: 00fbbf1249d4b7cb16b6f1046bb6b647c82893a2
Found in base branch: develop
A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
Publish Date: 2021-03-19
URL: CVE-2019-10196
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.npmjs.com/advisories/607
Release Date: 2021-03-19
Fix Resolution (http-proxy-agent): 2.1.0
Direct dependency fix Resolution (@vue/cli-plugin-e2e-nightwatch): 4.0.0
Step up your Open Source Security Game with Mend here