Executive brief
The bl library is a Node.js utility for working with buffers. When bl.append() is called with a number argument, it incorrectly creates a buffer with uninitialized memory content instead of creating an empty buffer of that size. This can expose sensitive data that happened to be in memory at that location to anyone using the library.
Technical details
The vulnerability is a memory exposure issue (CWE-200) in the bl library's append method. When bl.append(number) is invoked, the code passes the number directly to the Node.js Buffer constructor, which prior to Node.js 4.5.0 created a buffer filled with whatever data happened to be in that memory location. An attacker or unprivileged application that calls this method with a numeric argument can read uninitialized memory containing sensitive data. The issue affects all versions before 0.9.5 and 1.0.0–1.0.0 (fixed in 1.0.1). The fix coerces numeric arguments to strings or rejects them.
Affected products
- bl bl before 0.9.5 and 1.0.0 to 1.0.0
Timeline
- 2019-06-03: disclosed
- 2016-01-19: other: Pull request filed to fix the issue