GHSA-PC5P-H8PF-MVWP中危已审查

Machine-In-The-Middle in https-proxy-agent

OSV 1.4.0 · github-reviewed · 修改于 2023-11-02 04:54

发布时间

2020-04-16 11:14

GitHub 审查时间

2020-04-16 11:03

NVD 发布时间

—

源文件

advisories/github-reviewed/2020/04/GHSA-pc5p-h8pf-mvwp/GHSA-pc5p-h8pf-mvwp.json

公告说明

Versions of https-proxy-agent prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.

Recommendation

Upgrade to version 3.0.0 or 2.2.3.

受影响的软件包

npm

https-proxy-agent

ECOSYSTEM

引入02.2.3

标识信息

别名 / CVE

无

CWE

CWE-300

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-pc5p-h8pf-mvwp",
  "aliases": [],
  "details": "Versions of `https-proxy-agent` prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.\n\n\n## Recommendation\n\nUpgrade to version 3.0.0 or 2.2.3.",
  "summary": "Machine-In-The-Middle in https-proxy-agent",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.3"
            }
          ]
        }
      ],
      "package": {
        "name": "https-proxy-agent",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2023-11-01T20:54:11Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
    }
  ],
  "published": "2020-04-16T03:14:56Z",
  "references": [
    {
      "url": "https://github.com/TooTallNate/node-https-proxy-agent/commit/36d8cf509f877fa44f4404fce57ebaf9410fe51b",
      "type": "WEB"
    },
    {
      "url": "https://hackerone.com/reports/541502",
      "type": "WEB"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JS-HTTPSPROXYAGENT-469131",
      "type": "WEB"
    },
    {
      "url": "https://www.npmjs.com/advisories/1184",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-300"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-04-16T03:03:19Z"
  }
}