CVE-2024-38372 - Vulnerability Details - OpenCVE

Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nodejs	Undici

No data.

No data.

References

Link	Providers
https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36
https://github.com/nodejs/undici/issues/3328
https://github.com/nodejs/undici/issues/3337
https://github.com/nodejs/undici/pull/3338
https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq
https://security.netapp.com/advisory/ntap-20240828-0009/

History

Thu, 29 Aug 2024 20:30:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:nodejs:undici:6.14.0:::::::*
Vendors & Products	Nodejs Nodejs undici
References		https://security.netapp.com/advisory/ntap-20240828-0009/
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-07-08T20:25:59.111Z

Updated: 2024-08-28T15:02:48.392Z

Reserved: 2024-06-14T14:16:16.466Z

Link: CVE-2024-38372

Vulnrichment

Updated: 2024-08-28T15:02:48.392Z

NVD

Status : Awaiting Analysis

Published: 2024-07-08T21:15:12.033

Modified: 2024-11-21T09:25:31.153

Link: CVE-2024-38372

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38372", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-06-14T14:16:16.466Z", "datePublished": "2024-07-08T20:25:59.111Z", "dateUpdated": "2024-08-28T15:02:48.392Z"}, "containers": {"cna": {"title": "Undici vulnerable to data leak when using response.arrayBuffer()", "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "lang": "en", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq"}, {"name": "https://github.com/nodejs/undici/issues/3328", "tags": ["x_refsource_MISC"], "url": "https://github.com/nodejs/undici/issues/3328"}, {"name": "https://github.com/nodejs/undici/issues/3337", "tags": ["x_refsource_MISC"], "url": "https://github.com/nodejs/undici/issues/3337"}, {"name": "https://github.com/nodejs/undici/pull/3338", "tags": ["x_refsource_MISC"], "url": "https://github.com/nodejs/undici/pull/3338"}, {"name": "https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36", "tags": ["x_refsource_MISC"], "url": "https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36"}], "affected": [{"vendor": "nodejs", "product": "undici", "versions": [{"version": ">= 6.14.0, < 6.19.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-08T20:25:59.111Z"}, "descriptions": [{"lang": "en", "value": "Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2."}], "source": {"advisory": "GHSA-3g92-w8c5-73pq", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "nodejs", "product": "undici", "cpes": ["cpe:2.3:a:nodejs:undici:6.14.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.14.0", "status": "affected", "lessThan": "6.19.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-11T20:29:36.252422Z", "id": "CVE-2024-38372", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T17:01:03.665Z"}}, {"title": "CVE Program Container", "references": [{"name": "https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq"}, {"name": "https://github.com/nodejs/undici/issues/3328", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/nodejs/undici/issues/3328"}, {"name": "https://github.com/nodejs/undici/issues/3337", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/nodejs/undici/issues/3337"}, {"name": "https://github.com/nodejs/undici/pull/3338", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/nodejs/undici/pull/3338"}, {"name": "https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36"}, {"url": "https://security.netapp.com/advisory/ntap-20240828-0009/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-28T15:02:48.392Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq", "name": "https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/nodejs/undici/issues/3328", "name": "https://github.com/nodejs/undici/issues/3328", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/nodejs/undici/issues/3337", "name": "https://github.com/nodejs/undici/issues/3337", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/nodejs/undici/pull/3338", "name": "https://github.com/nodejs/undici/pull/3338", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36", "name": "https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240828-0009/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-28T15:02:48.392Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38372", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-11T20:29:36.252422Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:nodejs:undici:6.14.0:*:*:*:*:*:*:*"], "vendor": "nodejs", "product": "undici", "versions": [{"status": "affected", "version": "6.14.0", "lessThan": "6.19.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-11T20:32:39.854Z"}}], "cna": {"title": "Undici vulnerable to data leak when using response.arrayBuffer()", "source": {"advisory": "GHSA-3g92-w8c5-73pq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nodejs", "product": "undici", "versions": [{"status": "affected", "version": ">= 6.14.0, < 6.19.2"}]}], "references": [{"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq", "name": "https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nodejs/undici/issues/3328", "name": "https://github.com/nodejs/undici/issues/3328", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nodejs/undici/issues/3337", "name": "https://github.com/nodejs/undici/issues/3337", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nodejs/undici/pull/3338", "name": "https://github.com/nodejs/undici/pull/3338", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36", "name": "https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-08T20:25:59.111Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38372", "state": "PUBLISHED", "dateUpdated": "2024-08-28T15:02:48.392Z", "dateReserved": "2024-06-14T14:16:16.466Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-07-08T20:25:59.111Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2."}, {"lang": "es", "value": "Undici es un cliente HTTP/1.1, escrito desde cero para Node.js. Dependiendo de las condiciones de la red y del proceso de una solicitud `fetch()`, `response.arrayBuffer()` podr\u00eda incluir parte de la memoria del proceso Node.js. Esto ha sido parcheado en v6.19.2."}], "id": "CVE-2024-38372", "lastModified": "2024-11-21T09:25:31.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-07-08T21:15:12.033", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36"}, {"source": "security-advisories@github.com", "url": "https://github.com/nodejs/undici/issues/3328"}, {"source": "security-advisories@github.com", "url": "https://github.com/nodejs/undici/issues/3337"}, {"source": "security-advisories@github.com", "url": "https://github.com/nodejs/undici/pull/3338"}, {"source": "security-advisories@github.com", "url": "https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/nodejs/undici/issues/3328"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/nodejs/undici/issues/3337"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/nodejs/undici/pull/3338"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20240828-0009/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "security-advisories@github.com", "type": "Secondary"}]}