The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
| Link | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/ | vendor advisory |
| https://hackerone.com/reports/965914 | third party advisory permissions required |
| https://security.gentoo.org/glsa/202009-15 | third party advisory vendor advisory |
| https://usn.ubuntu.com/4548-1/ | third party advisory vendor advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html | third party advisory vendor advisory |
| https://security.netapp.com/advisory/ntap-20201009-0004/ | third party advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html | vendor advisory mailing list third party advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/ | vendor advisory |