[ASA-202107-36] libuv: information disclosure

[Jonas Witschel]

Arch Linux Security Advisory ASA-202107-36
==========================================

Severity: Medium
Date    : 2021-07-20
CVE-ID  : CVE-2021-22918
Package : libuv
Type    : information disclosure
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2131

Summary
=======

The package libuv before version 1.41.1-1 is vulnerable to information
disclosure.

Resolution
==========

Upgrade to 1.41.1-1.

# pacman -Syu "libuv>=1.41.1-1"

The problem has been fixed upstream in version 1.41.1.

Workaround
==========

None.

Description
===========

libuv before version 1.14.1, as bundled by Node.js before versions
16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in
the libuv's uv__idna_toascii() function which is used to convert
strings to ASCII. This is called by Node's dns module's lookup()
function and can lead to information disclosures or crashes.

Impact
======

Attempting to look up a crafted domain name could disclose sensitive
information or crash an application using libuv.

References
==========

https://github.com/libuv/libuv/issues/3147
https://hackerone.com/reports/1209681
https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de21b9
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv-upgrade-out-of-bounds-read-medium-cve-2021-22918
https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631829
https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac358
https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc096a7
https://security.archlinux.org/CVE-2021-22918
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210720/255c1255/attachment-0001.sig>