CVE-2021-23386

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-23386
This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.3

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56 Patch Third Party Advisory
https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858 Permissions Required Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719 Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 Patch Third Party Advisory
https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56 Patch Third Party Advisory
https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858 Permissions Required Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719 Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:dns-packet_project:dns-packet:*:*:*:*:*:node.js:*:*
cpe:2.3:a:dns-packet_project:dns-packet:*:*:*:*:*:node.js:*:*
History

21 Nov 2024, 05:51

Type Values Removed Values Added
CVSS v2 : 4.0
v3 : 6.5 		v2 : 4.0
v3 : 7.7
References () https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56 - Patch, Third Party Advisory () https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56 - Patch, Third Party Advisory
References () https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858 - Permissions Required, Third Party Advisory () https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858 - Permissions Required, Third Party Advisory
References () https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719 - Patch, Third Party Advisory () https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719 - Patch, Third Party Advisory
References () https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 - Patch, Third Party Advisory () https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 - Patch, Third Party Advisory

12 Jul 2022, 17:42

Type Values Removed Values Added
CWE CWE-200 CWE-909

01 Jun 2021, 13:59

Type Values Removed Values Added
References (MISC) https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719 - Third Party Advisory (MISC) https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719 - Patch, Third Party Advisory
References (MISC) https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 - Third Party Advisory (MISC) https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 - Patch, Third Party Advisory

26 May 2021, 15:50

Type Values Removed Values Added
References (MISC) https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719 - (MISC) https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719 - Third Party Advisory
References (MISC) https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858 - (MISC) https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858 - Permissions Required, Third Party Advisory
References (MISC) https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 - (MISC) https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 - Third Party Advisory
References (MISC) https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56 - (MISC) https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56 - Patch, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : 4.0
v3 : 6.5
CPE cpe:2.3:a:dns-packet_project:dns-packet:*:*:*:*:*:node.js:*:*
CWE CWE-200

20 May 2021, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-05-20 17:15

Updated : 2024-11-21 05:51

NVD link : CVE-2021-23386

Mitre link : CVE-2021-23386

CVE.ORG link : CVE-2021-23386

JSON object : View

Products Affected

dns-packet_project

  • dns-packet
CWE
CWE-909

Missing Initialization of Resource