Improper input validation in Node.js - CVE-2018-7162
Published: June 18, 2018
Vulnerability identifier: #VU13377
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-7162
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to insufficient input validation when TLS implementation. A remote attacker can send a specially crafted request that submits malicious input to the targeted node server and cause it to crash.
Affected software
Node.js
Gentoo Linux
Fedora
nodejs
Gentoo Linux
Fedora
nodejs
How to mitigate CVE-2018-7162
Update to version 10.4.1.
Node.js - update to 10.4.1
nodejs - addressed in versions 6.14.3-1.el7, 8.11.3-1.fc27, 8.11.3-1.fc28
nodejs - addressed in versions 6.14.3-1.el7, 8.11.3-1.fc27, 8.11.3-1.fc28