CVE-2019-10196: fedoraproject fedora Improper Initialization

Modified

AliasesGHSA-86wf-436m-h424

Published 19-03-2021Last modified 04-08-2024

Vulnerability summary

CVE-2019-10196 is a critical (CVSS 9.8) Improper Initialization vulnerability in fedoraproject fedora. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 72.3% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

1.39%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

19-03-2021
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.