ArchLinux: 202107-36: libuv: information disclosure | LinuxSecurity...

Advisories

Arch Linux Security Advisory ASA-202107-36
==========================================

Severity: Medium
Date    : 2021-07-20
CVE-ID  : CVE-2021-22918
Package : libuv
Type    : information disclosure
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2131

Summary
=======

The package libuv before version 1.41.1-1 is vulnerable to information
disclosure.

Resolution
==========

Upgrade to 1.41.1-1.

# pacman -Syu "libuv>=1.41.1-1"

The problem has been fixed upstream in version 1.41.1.

Workaround
==========

None.

Description
===========

libuv before version 1.14.1, as bundled by Node.js before versions
16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in
the libuv's uv__idna_toascii() function which is used to convert
strings to ASCII. This is called by Node's dns module's lookup()
function and can lead to information disclosures or crashes.

Impact
======

Attempting to look up a crafted domain name could disclose sensitive
information or crash an application using libuv.

References
==========

https://github.com/libuv/libuv/issues/3147
https://hackerone.com/reports/1209681
https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de21b9
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv-upgrade-out-of-bounds-read-medium-cve-2021-22918
https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631829
https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac358
https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc096a7
https://security.archlinux.org/CVE-2021-22918

ArchLinux: 202107-36: libuv: information disclosure

July 20, 2021
The package libuv before version 1.41.1-1 is vulnerable to information disclosure

Summary

libuv before version 1.14.1, as bundled by Node.js before versions 16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.

Resolution

Upgrade to 1.41.1-1.
# pacman -Syu "libuv>=1.41.1-1"
The problem has been fixed upstream in version 1.41.1.

References

https://github.com/libuv/libuv/issues/3147 https://hackerone.com/reports/1209681 https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de21b9 https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv-upgrade-out-of-bounds-read-medium-cve-2021-22918 https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631829 https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac358 https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc096a7 https://security.archlinux.org/CVE-2021-22918

Severity
CVE-ID : CVE-2021-22918
Package : libuv
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-2131

Impact

Attempting to look up a crafted domain name could disclose sensitive information or crash an application using libuv.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.