{"id":"GHSA-53mj-mc38-q894","summary":"Remote Memory Exposure in openwhisk","details":"Versions of `openwhisk` before 3.3.1 are vulnerable to remote memory exposure.\n\nWhen a number is passed to `api_key`, affected versions of `openwhisk` allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).\n\nProof of concept:\n\n```js\nvar openwhisk = require('openwhisk');\nvar options = {\n  apihost: '127.0.0.1:1433', \n  api_key: USERSUPPLIEDINPUT // number\n};\nvar ow = openwhisk(options);\now.actions.invoke({actionName: 'sample'}).then(result =\u003e console.log(result))\n```\n\n\n## Recommendation\n\nUpdate to version 3.3.1 or later.","modified":"2021-09-24T14:29:02Z","published":"2020-09-01T19:40:41Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2020-08-31T18:29:24Z","nvd_published_at":null,"cwe_ids":[],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/openwhisk/openwhisk-client-js/pull/34"},{"type":"PACKAGE","url":"https://github.com/openwhisk/openwhisk-client-js"},{"type":"WEB","url":"https://www.npmjs.com/advisories/600"}],"affected":[{"package":{"name":"openwhisk","ecosystem":"npm","purl":"pkg:npm/openwhisk"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-53mj-mc38-q894/GHSA-53mj-mc38-q894.json"}}],"schema_version":"1.9.0"}