HTTP response splitting in Node.js - CVE-2018-7159

Vulnerability identifier: #VU12575

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7159

CWE-ID: CWE-113

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to write arbitrary files on the target system.

The weakness exists due to spaces in Content-Length HTTP headers from Node.js’s HTTP module entirely ignore spaces within the value, despite the HTTP specification not allowing spaces within the values. A remote attacker can confuse the script and write arbitrary files.

Node.js
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Fedora
nodejs-current (Alpine package)
libuv
nodejs

Update to version 4.9.0.

nodejs-current (Alpine package) - update to 9.10.1-r0
libuv - addressed in versions 1.19.2-1.el7, 1.19.2-1.fc27
nodejs - addressed in versions 6.14.0-1.el7, 6.14.0-1.fc26, 6-20180328185917.c2c572ec, 8.11.0-1.fc27, 8.11.0-1.fc28, 8-20180328183715.c2c572ec, 9-20180405175619.c7b355af

• https://nodesource.com/blog/node-js-security-release-summary-march-2018/

• Multiple vulnerabilities in Node.js
• Red Hat update for http-parser
• Amazon Linux AMI update for http-parser
• HTTP response splitting in nodejs-current (Alpine package)
• Fedora 28 Modular update for nodejs
• Fedora 28 Modular update for nodejs
• Fedora 28 Modular update for nodejs
• Fedora 27 update for libuv, nodejs
• Fedora 28 update for nodejs
• Fedora 26 update for nodejs
• Fedora EPEL 7 update for libuv, nodejs