Improper input validation in Node.js - CVE-2018-7161
Published: June 16, 2018 / Updated: June 18, 2018
Vulnerability identifier: #VU13376
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-7161
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to a cleanup bug where objects are used in native code after they are no longer available when the affected software interacts with an HTTP/2 server. A remote attacker can send a specially crafted request that submits malicious input to the targeted node server that provides an HTTP/2 server and cause the node server to crash.
Affected software
Node.js
Gentoo Linux
Fedora
Opensuse
nodejs (Alpine package)
nodejs
Gentoo Linux
Fedora
Opensuse
nodejs (Alpine package)
nodejs
How to mitigate CVE-2018-7161
Update to version 10.4.1.
Node.js - update to 10.4.1
nodejs (Alpine package) - update to 8.11.3-r0
nodejs - addressed in versions 6.14.3-1.el7, 8.11.3-1.fc27, 8.11.3-1.fc28
nodejs (Alpine package) - update to 8.11.3-r0
nodejs - addressed in versions 6.14.3-1.el7, 8.11.3-1.fc27, 8.11.3-1.fc28