Resource exhaustion in Node.js - CVE-2018-7158

Vulnerability identifier: #VU12573

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7158

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the splitPathRe regular expression used in the core Node.js path module for POSIX path parsing functions due to resource exhaustion. A remote attacker can cause the service to crash by taking a non-trivial amount of time to parse the value against the RegEx.

Node.js
Fedora
nodejs-current (Alpine package)
libuv
nodejs

Update to version 4.9.0.

nodejs-current (Alpine package) - update to 9.10.1-r0
libuv - addressed in versions 1.19.2-1.el7, 1.19.2-1.fc27
nodejs - addressed in versions 6.14.0-1.el7, 6.14.0-1.fc26, 6-20180328185917.c2c572ec, 8.11.0-1.fc27, 8.11.0-1.fc28, 8-20180328183715.c2c572ec, 9-20180405175619.c7b355af

• https://nodesource.com/blog/node-js-security-release-summary-march-2018/

• Multiple vulnerabilities in Node.js
• Resource exhaustion in nodejs-current (Alpine package)
• Fedora 28 Modular update for nodejs
• Fedora 28 Modular update for nodejs
• Fedora 28 Modular update for nodejs
• Fedora 27 update for libuv, nodejs
• Fedora 28 update for nodejs
• Fedora 26 update for nodejs
• Fedora EPEL 7 update for libuv, nodejs