[Pkg-javascript-devel] Bug#969309: node-bl: CVE-2020-8244

[Salvatore Bonaccorso]

Source: node-bl
Version: 4.0.2-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for node-bl.

CVE-2020-8244[0]:
| A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1 and
| <2.2.1 which could allow an attacker to supply user input (even
| typed) that if it ends up in consume() argument and can become
| negative, the BufferList state can be corrupted, tricking it into
| exposing uninitialized memory via regular .slice() calls.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-8244
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8244
[1] https://github.com/rvagg/bl/commit/d3e240e3b8ba4048d3c76ef5fb9dd1f8872d3190
[2] https://hackerone.com/reports/966347

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore