« Volver al listado

CVE-2018-7166

Estado: ModificadaAlta (7.5)—

In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nodejs — Node.js

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-7166",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve-request@iojs.org",
      "affectedData": [
        {
          "vendor": "The Node.js Project",
          "product": "Node.js",
          "versions": [
            {
              "status": "affected",
              "version": "All versions of Node.js 10 prior to 10.9.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-08-21T12:29:00.320",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:2553",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve-request@iojs.org"
    },
    {
      "url": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve-request@iojs.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:2553",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve-request@iojs.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-226"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-908"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal \"fill\" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information."
    },
    {
      "lang": "es",
      "value": "En todas las versiones de Node.js 10 anteriores a la 10.9.0, un fallo en el procesamiento de argumentos puede provocar que \"Buffer.alloc()\" devuelva memoria no inicializada. Este método está diseñado para ser seguro y solo devuelve la memoria inicializada o borrada. El tercer argumento que especifica \"encoding\" puede ser pasado como un número. Esto es malinterpretado por el método interno \"fill\" del búfer como el \"comienzo\" de una operación de llenado (fill). Este defecto puede ser explotado cuando los argumentos \"Buffer.alloc()\" se derivan de la entrada del usuario para devolver bloques de memoria no borrados que pueden contener información sensible."
    }
  ],
  "lastModified": "2026-06-17T02:02:43.710",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48A01678-361E-4F23-B7D6-41B0C145F491",
              "versionEndExcluding": "10.9.0",
              "versionStartIncluding": "10.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-request@iojs.org"
}