CVE-2024-38372: Undici vulnerable to data leak when using response.arrayBuffer()
Impact
Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process.
Patches
This has been patched in v6.19.2.
Workarounds
There are no known workaround.
References
https://github.com/nodejs/undici/issues/3337 https://github.com/nodejs/undici/issues/3328 https://github.com/nodejs/undici/pull/3338 https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36
Other sources
Node.js undici could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when using the response.arrayBuffer() function. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
— IBM
Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process. This has been patched in v6.19.2.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38372?
CVE-2024-38372 has been categorized with a high severity due to potential exposure of sensitive memory contents.
How do I fix CVE-2024-38372?
To remediate CVE-2024-38372, upgrade to version 6.19.2 or later of the affected 'undici' package.
What versions of 'undici' are affected by CVE-2024-38372?
CVE-2024-38372 affects 'undici' versions from 6.14.0 up to but not including 6.19.2.
Are there any workarounds for CVE-2024-38372?
Currently, there are no known workarounds for CVE-2024-38372.
Which products are impacted by CVE-2024-38372?
CVE-2024-38372 impacts IBM Cognos Dashboards on Cloud Pak for Data versions up to 5.0.0 and 4.8.0.