CVE-2024-21525: node-twain vulnerable to Improper Check or Handling of Exceptional Conditions

July 10, 2024

All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the source data not being checked. Creating a new twain.TwainSDK with a productName or productFamily, manufacturer, version.info property of length >= 34 chars leads to a buffer overflow vulnerability.

References

gist.github.com/dellalibera/55b87634a6c360e5be22a715f0566c99
github.com/Luomusha/node-twain
github.com/advisories/GHSA-wxr3-2hgv-qm8f
nvd.nist.gov/vuln/detail/CVE-2024-21525
security.snyk.io/vuln/SNYK-JS-NODETWAIN-6421153

Code Behaviors & Features

Detect and mitigate CVE-2024-21525 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →