SB2018061329 - Improper input validation in nodejs (Alpine package)

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2018-7161)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to a cleanup bug where objects are used in native code after they are no longer available when the affected software interacts with an HTTP/2 server. A remote attacker can send a specially crafted request that submits malicious input to the targeted node server that provides an HTTP/2 server and cause the node server to crash.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=92947a81c0654add42b67742a3d44a6e6fa5720e
• https://git.alpinelinux.org/aports/commit/?id=ac65e68608103c3c2f02485f153bf92beff3db46