Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-c3t5-82ea-5yh6
|
Remote Memory Exposure in openwhisk
Versions of `openwhisk` before 3.3.1 are vulnerable to remote memory exposure.
When a number is passed to `api_key`, affected versions of `openwhisk` allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).
Proof of concept:
```js
var openwhisk = require('openwhisk');
var options = {
apihost: '127.0.0.1:1433',
api_key: USERSUPPLIEDINPUT // number
};
var ow = openwhisk(options);
ow.actions.invoke({actionName: 'sample'}).then(result => console.log(result))
```
## Recommendation
Update to version 3.3.1 or later.
|
GHSA-53mj-mc38-q894
GMS-2020-756
|