Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().
The product reads data past the end, or before the beginning, of the intended buffer.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Node.js | Nodejs | 12.0.0 (including) | 12.22.2 (excluding) |
Node.js | Nodejs | 14.0.0 (including) | 14.17.2 (excluding) |
Node.js | Nodejs | 16.0.0 (including) | 16.4.1 (excluding) |
Red Hat Enterprise Linux 8 | RedHat | nodejs:12-8040020210708131418.522a0ee4 | * |
Red Hat Enterprise Linux 8 | RedHat | nodejs:14-8040020210708154809.522a0ee4 | * |
Red Hat Enterprise Linux 8 | RedHat | libuv-1:1.41.1-1.el8_4 | * |
Red Hat Enterprise Linux 8.1 Extended Update Support | RedHat | nodejs:12-8010020210817113128.c27ad7f8 | * |
Red Hat Enterprise Linux 8.2 Extended Update Support | RedHat | nodejs:12-8020020210817125332.4cda2c84 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs12-nodejs-0:12.22.2-1.el7 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs12-nodejs-nodemon-0:2.0.3-2.el7 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-nodejs-0:14.17.2-1.el7 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-nodejs-nodemon-0:2.0.3-2.el7 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs12-nodejs-0:12.22.2-1.el7 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs12-nodejs-nodemon-0:2.0.3-2.el7 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs14-nodejs-0:14.17.2-1.el7 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs14-nodejs-nodemon-0:2.0.3-2.el7 | * |
Libuv1 | Ubuntu | devel | * |
Libuv1 | Ubuntu | focal | * |
Libuv1 | Ubuntu | groovy | * |
Libuv1 | Ubuntu | hirsute | * |
Libuv1 | Ubuntu | impish | * |
Libuv1 | Ubuntu | jammy | * |
Libuv1 | Ubuntu | trusty | * |