{"id":"CVE-2020-8244","aliases":["CLSA-2026-1772756021","CLSA-2026-1774225189","CLSA-2026-1776731791","CLSA-2026-1792491634","DEBIAN-CVE-2020-8244","DLA-2698-1","EUVD-2020-1218","GHSA-pp7h-53gx-mx7r","GHSA-wrw9-m778-g6mc","UBUNTU-CVE-2020-8244","USN-5098-1","USN-5159-1"],"status":"published","title":"Remote Memory Exposure in bl","description":"A buffer over-read vulnerability exists in bl \u003c4.0.3, \u003c3.0.1, \u003c2.2.1, and \u003c1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02097,"percentile":0.81809,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-126","CWE-200"],"published":"2019-06-03T17:27:57Z","modified":"2026-10-26T12:00:55Z","fixes":[{"ecosystem":"npm","package":"bl","fixed_in":["3.0.1","4.0.3","1.2.3","2.2.1","0.9.5","1.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"bl","fixed_in":["1.0.0-tuxcare.1","0.9.5-tuxcare.1","1.1.2-tuxcare.1","0.8.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-bl","fixed_in":["4.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-bl","fixed_in":["4.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-bl","fixed_in":["4.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"node-bl","fixed_in":["1.1.2-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-bl","fixed_in":["0.9.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"node-bl","fixed_in":["1.1.2-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.0.0"},{"fixed":"3.0.1"}]}],"versions":["3.0.0"]},{"source":"ghsa","ecosystem":"npm","package":"bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-tuxcare.0"},{"fixed":"1.0.0-tuxcare.1"}]}],"versions":["1.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.5-tuxcare.0"},{"fixed":"0.9.5-tuxcare.1"}]}],"versions":["0.9.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.2-tuxcare.0"},{"fixed":"1.1.2-tuxcare.1"}]}],"versions":["1.1.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.2-tuxcare.0"},{"fixed":"0.8.2-tuxcare.1"}]}],"versions":["0.8.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"node-bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-1+deb9u1"}]}],"versions":["1.1.2-1"]},{"source":"osv","ecosystem":"npm","package":"bl","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.3"}]}]},{"source":"osv","ecosystem":"npm","package":"bl","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.2.1"}]}]},{"source":"osv","ecosystem":"npm","package":"bl","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.1"}]}],"versions":["3.0.0"]},{"source":"osv","ecosystem":"npm","package":"bl","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"bl","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.5"}]}]},{"source":"osv","ecosystem":"npm","package":"bl","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-1ubuntu0.1~esm1"}]}],"versions":["0.9.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-1ubuntu1.1"}]}],"versions":["1.1.2-1","1.1.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2-3","4.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-1ubuntu1.1"}]}],"versions":["1.1.2-1","1.1.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-bl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-1ubuntu0.1~esm1"}]}],"versions":["0.9.3-1"]}],"products":[{"vendor":"bufferlist_project","product":"bufferlist"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://hackerone.com/reports/966347","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8244","tags":["advisory"]},{"url":"https://github.com/rvagg/bl/commit/8a8c13c880e2bef519133ea43e0e9b78b5d0c91e","tags":["web"]},{"url":"https://github.com/rvagg/bl/commit/d3e240e3b8ba4048d3c76ef5fb9dd1f8872d3190","tags":["web","report"]},{"url":"https://github.com/rvagg/bl/commit/dacc4ac7d5fcd6201bcf26fbd886951be9537466","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pp7h-53gx-mx7r"},{"url":"https://github.com/rvagg/bl/pull/22","tags":["web"]},{"url":"https://www.npmjs.com/advisories/596","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wrw9-m778-g6mc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8244","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8244","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5098-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5159-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8244","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-8244","description":"A buffer over-read vulnerability exists in bl \u003c4.0.3, \u003c3.0.1, \u003c2.2.1, and \u003c1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.","status":"published","published":"2020-08-30T13:43:55Z","modified":"2024-08-04T09:56:28.05Z","cwes":["CWE-126"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-1218","description":"A buffer over-read vulnerability exists in bl \u003c4.0.3, \u003c3.0.1, \u003c2.2.1, and \u003c1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.","status":"published","published":"2020-08-30T13:43:55Z","modified":"2024-08-04T09:56:28Z","updated_at":"2026-11-03T03:07:57.599144Z"}],"ghsa":[{"id":"GHSA-pp7h-53gx-mx7r","title":"Remote Memory Exposure in bl","description":"A buffer over-read vulnerability exists in bl \u003c4.0.3, \u003c3.0.1, \u003c2.2.1, and \u003c1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.","status":"published","published":"2020-09-02T15:26:19Z","modified":"2023-02-01T05:04:58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125","CWE-126"],"updated_at":"2026-11-02T14:36:32.120868Z"},{"id":"GHSA-wrw9-m778-g6mc","title":"Memory Exposure in bl","description":"Versions of `bl` before 0.9.5 and 1.0.1 are vulnerable to memory exposure.\n\n`bl.append(number)` in the affected `bl` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory\n\n\n## Recommendation\n\nUpdate to version 0.9.5, 1.0.1 or later.","status":"published","published":"2019-06-03T17:27:57Z","modified":"2023-01-09T05:01:38Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2020-8244","description":"A buffer over-read vulnerability exists in bl \u003c4.0.3, \u003c3.0.1, \u003c2.2.1, and \u003c1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.","status":"published","published":"2020-08-30T15:15:12.167Z","modified":"2026-06-17T03:26:07.343Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-126","CWE-125"],"updated_at":"2026-11-02T14:06:13.600965Z"}],"osv":[{"id":"CVE-2020-8244","description":"A buffer over-read vulnerability exists in bl \u003c4.0.3, \u003c3.0.1, \u003c2.2.1, and \u003c1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.","status":"published","published":"2020-08-30T15:15:12.167Z","modified":"2026-10-24T10:30:17.0144725Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8244","description":"A buffer over-read vulnerability exists in bl \u003c4.0.3, \u003c3.0.1, \u003c2.2.1, and \u003c1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.","status":"published","published":"2020-08-30T15:15:12.167Z","modified":"2026-10-26T12:00:55.948252745Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-pp7h-53gx-mx7r","title":"Remote Memory Exposure in bl","description":"A buffer over-read vulnerability exists in bl \u003c4.0.3, \u003c3.0.1, \u003c2.2.1, and \u003c1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.","status":"published","published":"2020-09-02T15:26:19Z","modified":"2023-11-08T04:04:15.963824Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125","CWE-126"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"UBUNTU-CVE-2020-8244","description":"A buffer over-read vulnerability exists in bl \u003c4.0.3, \u003c3.0.1, \u003c2.2.1, and \u003c1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.","status":"published","published":"2020-08-30T15:15:00Z","modified":"2026-02-04T04:37:53.85086Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"CLSA-2026-1772756021","title":"TuxCare security update for bl (2 CVEs)","description":"TuxCare rebuilt bl to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:45:27.185554405Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1774225189","title":"TuxCare security update for bl (1 CVE)","description":"TuxCare rebuilt bl to address 1 CVE. Fixed in 0.9.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:00.116214137Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776731791","title":"TuxCare security update for bl (1 CVE)","description":"TuxCare rebuilt bl to address 1 CVE. Fixed in 1.1.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:34.460356087Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1792491634","title":"TuxCare security update for bl (2 CVEs)","description":"TuxCare rebuilt bl to address 2 CVEs. Fixed in 0.8.2-tuxcare.1.","status":"published","published":"2026-10-20T10:20:34Z","modified":"2026-10-20T13:45:16.968097396Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"DLA-2698-1","title":"node-bl - security update","status":"published","published":"2021-07-01T00:00:00Z","modified":"2026-03-09T01:20:02.21761Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"GHSA-wrw9-m778-g6mc","title":"Memory Exposure in bl","description":"Versions of `bl` before 0.9.5 and 1.0.1 are vulnerable to memory exposure.\n\n`bl.append(number)` in the affected `bl` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory\n\n\n## Recommendation\n\nUpdate to version 0.9.5, 1.0.1 or later.","status":"published","published":"2019-06-03T17:27:57Z","modified":"2020-08-31T18:29:15Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"USN-5098-1","title":"node-bl vulnerability","description":"It was discovered that bl didn't properly sanitize the inputs. An attacker\ncould use this to leak sensitive information.\n","status":"published","published":"2021-09-30T21:03:10Z","modified":"2026-04-27T15:57:48.1861Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5159-1","title":"node-bl vulnerability","description":"It was discovered that bl incorrectly handled certain inputs. An attacker\ncould possibly use this issue to cause a denial of service.\n","status":"published","published":"2022-02-08T22:24:46Z","modified":"2026-06-25T13:30:51.43228412Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}