npm bl 缓冲区错误漏洞

漏洞介绍

npm bl 4.x系列中4.0.3之前版本，3.x系列中3.0.1之前版本，2.x系列中2.2.1之前版本存在安全漏洞，攻击者可以通过恶意输入导致越界读。

漏洞补丁

目前厂商已发布升级了npm bl 缓冲区错误漏洞的补丁，npm bl 缓冲区错误漏洞的补丁获取链接：

https://hackerone.com/reports/966347

参考网址

来源:MISC

链接：https://hackerone.com/reports/966347

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-in-node-js-bl-module-affects-ibm-cloud-pak-for-multicloud-management-managed-service/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-version-4-0-2-of-node-js-module-bl-included-in-ibm-netcool-operations-insight-1-6-1-x-has-a-security-vulnerability/

来源:nvd.nist.gov

链接：https://nvd.nist.gov/vuln/detail/CVE-2020-8244

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-middleware-software-affect-ibm-cloud-pak-for-automation-4/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-in-node-js-bl-module-affects-ibm-cloud-automation-manager/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-certified-container-is-vulnerable-to-cve-2020-8244/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-node-js-affect-ibm-app-connect-enterprise-v11-cve-2020-8244/

来源:vigilance.fr

链接：https://vigilance.fr/vulnerability/Node-js-bl-information-disclosure-33278

受影响实体

暂无

信息来源

http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202008-1431