CVE-2019-10196: Critical severity ibm security verify governance - identity manager vulnerability
A flaw was found in http-proxy-agent versions before 2.1.0. The http-proxy-agent passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
References: https://hackerone.com/reports/321631
Patch: https://github.com/TooTallNate/node-http-proxy-agent/commit/b7b7cc793c3226aa83f820ce5c277e81862d32eb
Other sources
A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
— MITRE
Node.js http-proxy-agent module is vulnerable to a denial of service, caused by a buffer allocation flaw. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to consume available CPU resources.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-10196?
CVE-2019-10196 is a vulnerability in the Node.js http-proxy-agent module that can result in a denial of service and data exposure.
What is the severity of CVE-2019-10196?
CVE-2019-10196 has a critical severity rating of 9.8 out of 10.
How does CVE-2019-10196 affect the affected software?
CVE-2019-10196 affects the Node.js http-proxy-agent module version up to 2.1.0, Fedora 27, Redhat Software Collections, and Redhat Enterprise Linux 7.0.
How can CVE-2019-10196 be exploited?
CVE-2019-10196 can be exploited by passing a specially crafted auth option to the Buffer constructor, leading to a denial of service and potential data exposure.
How can I fix CVE-2019-10196?
To fix CVE-2019-10196, upgrade to http-proxy-agent version 2.1.0 or later.