What is GHSA-wrw9-m778-g6mc?

GHSA-wrw9-m778-g6mc is a security advisory published by GitHub Security Advisories with Medium severity. Memory Exposure in bl

Why does GHSA-wrw9-m778-g6mc have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-wrw9-m778-g6mc?

GHSA-wrw9-m778-g6mc affects 2 products, including: npm/bl:\u003c 0.9.5; npm/bl:= 1.0.0.

GHSA-wrw9-m778-g6mcMediumDisclosed before NVD

Memory Exposure in bl

Vendor

GitHub Security Advisories

Published

June 3, 2019

Last Modified

January 9, 2023

📋 Description

Versions of bl before 0.9.5 and 1.0.1 are vulnerable to memory exposure.

bl.append(number) in the affected bl versions passes a number to Buffer constructor, appending a chunk of uninitialized memory

Recommendation

Update to version 0.9.5, 1.0.1 or later.

🎯 Affected products2

npm/bl:< 0.9.5
npm/bl:= 1.0.0

🔗 References (3)

https://github.com/rvagg/bl/pull/22
https://www.npmjs.com/advisories/596
https://github.com/advisories/GHSA-wrw9-m778-g6mc