Skip to content
Fencer Intel
medium —

GHSA-53mj-mc38-q894 json

Remote Memory Exposure in openwhisk

published 6y ago modified 5y ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Versions of `openwhisk` before 3.3.1 are vulnerable to remote memory exposure.

When a number is passed to `api_key`, affected versions of `openwhisk` allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).

Proof of concept:

```js var openwhisk = require('openwhisk'); var options = { apihost: '127.0.0.1:1433', api_key: USERSUPPLIEDINPUT // number }; var ow = openwhisk(options); ow.actions.invoke({actionName: 'sample'}).then(result => console.log(result)) ```

## Recommendation

Update to version 3.3.1 or later.

Patch / fix

  • npm openwhisk 3.3.1

Is GHSA-53mj-mc38-q894 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm openwhisk
<3.3.1
3.3.1

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.