Potential memory exposure in dns-packet

Description

This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

Recommendation

Update the dns-packet package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 2.0.0, < 5.2.2

  < 1.3.2**

• Patched version(s): **5.2.2

  1.3.2**

References

• GHSA-3wcq-x3mq-6r9p
• hackerone.com
• snyk.io
• CVE-2021-23386
• CWE-200
• CWE-908
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Exposure of Sensitive Information to an Unauthorized Actor in nanoid - CVE-2021-23566
• [thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values - CVE-2021-21412
• Basic-auth app bundle credential exposure in gatsby-source-wordpress - CVE-2021-32770
• Potential exposure of tokens to an Unauthorized Actor - CVE-2022-21671

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

dns-packet