redhat software-collections CVE-2019-10196 in Red Hat and Fedora Project Products
Published on March 19, 2021

product logo product logo
A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.

NVD

Weakness Type

Improper Initialization

The software does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.


Products Associated with CVE-2019-10196

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2019-10196 are published in these products:

Red Hat Software Collections
 
Fedora Project Fedora
 
Red Hat Enterprise Linux (RHEL)
 

Exploit Probability

EPSS
0.36%
Percentile
58.09%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.