WS-2018-0074 Medium Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

WS-2018-0074 - Medium Severity Vulnerability

Vulnerable Libraries - bl-0.9.3.tgz, bl-0.9.4.tgz

bl-0.9.3.tgz

Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!

path: /tmp/git/library/node_modules/ember-cli/node_modules/npm/node_modules/request/node_modules/bl/package.json

Library home page: http://registry.npmjs.org/bl/-/bl-0.9.3.tgz

Dependency Hierarchy:

• ember-cli-0.2.0-beta.1.tgz (Root Library)
  • npm-2.1.8.tgz
    • request-2.47.0.tgz
      • ❌ bl-0.9.3.tgz (Vulnerable Library)

bl-0.9.4.tgz

Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!

path: /tmp/git/library/node_modules/ember-cli/node_modules/bower/node_modules/tar-fs/node_modules/tar-stream/node_modules/bl/package.json

Library home page: http://registry.npmjs.org/bl/-/bl-0.9.4.tgz

Dependency Hierarchy:

• ember-cli-0.2.0-beta.1.tgz (Root Library)
  • bower-1.3.12.tgz
    • bower-registry-client-0.2.3.tgz
      • request-2.51.0.tgz
        • ❌ bl-0.9.4.tgz (Vulnerable Library)

Vulnerability Details

Versions of bl before 0.9.5 and 1.0.1 are vulnerable to memory exposure.

bl.append(number) in the affected bl versions passes a number to Buffer constructor, appending a chunk of uninitialized memory

Publish Date: 2018-04-25

URL: WS-2018-0074

CVSS 2 Score Details (5.0)

Base Score Metrics not available

---

Step up your Open Source Security Game with WhiteSource here