Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

openwhisk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmAmendedPublished

    Remote Memory Exposure in openwhisk

    GHSA-53mj-mc38-q894

    Affected
    • npm openwhisk < 3.3.1
    Fixed in
    3.3.1· Vendor fix available
    Issue
    Versions of openwhisk before 3.3.1 are vulnerable to remote memory exposure. When a number is passed to apikey, affected versions of openwhisk allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded). Proof of concept: Recommendation Update to version 3.3.1 or later.

    Recommended action: Upgrade to 3.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →