CVE-2020-8244: High severity ibm security guardium insights vulnerability
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Other sources
Node.js bl module could allow a remote attacker to obtain sensitive information, caused by a buffer over-read flaw in the consume function. By sending a specially-crafted argument, an attacker could exploit this vulnerability to obtain sensitive information, or cause a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-8244?
CVE-2020-8244 is a buffer over-read vulnerability in the bl module of Node.js.
How does CVE-2020-8244 impact IBM Security Guardium Insights?
IBM Security Guardium Insights versions 2.0.2 and earlier are affected by CVE-2020-8244.
How can an attacker exploit CVE-2020-8244?
An attacker can exploit CVE-2020-8244 by supplying user input that can become negative and corrupt the BufferList state to expose uninitialized memory.
What is the severity of CVE-2020-8244?
CVE-2020-8244 has a severity rating of 8.2 (High).
How can CVE-2020-8244 be fixed?
To fix CVE-2020-8244, upgrade to a version of bl module that is not affected, such as versions 4.0.3, 3.0.1, 2.2.1, or 1.2.3.