-
Notifications
You must be signed in to change notification settings - Fork 285
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Is Nodejs vulnerable to ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)? #2716
Comments
I don't know if this is the right place to enquire about his ICU vulnerability being used in Node. |
cc @nodejs/security @srl295 Would it be possible to find out which versions of ICU were affected? |
Adapting the testcase from https://bugs.chromium.org/p/chromium/issues/detail?id=1044570:
With Node.js 14.3.0:
Node.js 13.14.0:
Node.js 12.16.3:
Node.js 10.20.1 (can't run the test because of the
Visually inspecting |
In terms of updating the release: |
|
I included 67.1 in the v12.17.0 proposal. |
The fix was released in the most recent 10.x sec release. See https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/ I think that fixes this issue. |
I saw that the security issue affects version 58.1 as well. If I cherry pick the changes from the changeset 'ICU-20958 Prevent SEGV_MAPERR in append' |
Is Nodejs vulnerable to ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)?
Red Hat and many other vendors have released patches to patch the ICU buffer overflow issue in their platforms
As we notice, we have ICU being used in Nodejs.
Example: Node 8.x has "icu: '59.1' & Node 10.x has icu: '62.1'
Please see the below links for this ICU vulnerability
https://www.tenable.com/cve/CVE-2020-10531 ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)
https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20201317%20-%20Security%20Advisory
Red Hat has released an update for the nodejs:10 module to address the ICU issue.
I didn't find any reference from Nodejs security on this ICU issue.
Can anybody from Nodejs confirm if Nodejs is vulnerable for this ICU Integer Overflow vulnerability?
Thank you
The text was updated successfully, but these errors were encountered: