CVE-2021-22918 - log back

CVE-2021-22918 edited at 17 Jul 2021 11:25:18
Description
- Node.js before versions 16.4.1, 14.17.2 and 12.22.2 is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.
+ libuv before version 1.14.1, as bundled by Node.js before versions 16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.
References
+ https://github.com/libuv/libuv/issues/3147
+ https://hackerone.com/reports/1209681
+ https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de21b9
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv-upgrade-out-of-bounds-read-medium-cve-2021-22918
- https://hackerone.com/reports/1209681
https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631829
https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac358
https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc096a7
CVE-2021-22918 edited at 02 Jul 2021 08:55:43
References
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv-upgrade-out-of-bounds-read-medium-cve-2021-22918
+ https://hackerone.com/reports/1209681
+ https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631829
+ https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac358
+ https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc096a7
CVE-2021-22918 edited at 02 Jul 2021 08:46:18
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Information disclosure
Description
+ Node.js before versions 16.4.1, 14.17.2 and 12.22.2 is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.
References
+ https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv-upgrade-out-of-bounds-read-medium-cve-2021-22918
Notes
CVE-2021-22918 created at 02 Jul 2021 08:44:36