GHSA-53mj-mc38-q894: 
JavaScript vulnerability analysis and mitigation

A remote memory exposure vulnerability was identified in openwhisk versions prior to 3.3.1. The vulnerability was published to the GitHub Advisory Database on September 1, 2020, and last updated on January 9, 2023. The issue affects the npm package openwhisk and has been assigned the identifier GHSA-53mj-mc38-q894 with a moderate severity rating (GitHub Advisory).

The vulnerability occurs when a number is passed to the api_key parameter, causing affected versions of openwhisk to allocate an uninitialized buffer. This buffer is then sent over the network in the Authorization header using base64 encoding. The issue stems from improper buffer initialization and handling in the authentication process (GitHub Advisory).

When exploited, this vulnerability could lead to the exposure of memory contents through the Authorization header, potentially leaking sensitive information from the application's memory space (GitHub Advisory).

A proof of concept exists demonstrating the vulnerability by passing a numeric value to the api_key parameter in the openwhisk configuration options. The exploit can be triggered through a simple API call to the actions.invoke method (GitHub Advisory).

Users are recommended to update to openwhisk version 3.3.1 or later, which contains the fix for this vulnerability. The fix was implemented by replacing the use of new Buffer() with Buffer.from() to properly handle buffer initialization (OpenWhisk PR).