Improper input validation in Node.js - CVE-2018-7167
Published: June 18, 2018
Vulnerability identifier: #VU13379
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-7167
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can supply Calling Buffer.fill() or Buffer.alloc() with some parameters and cause the server to hang.
Affected software
Node.js
Gentoo Linux
Fedora
Opensuse
nodejs (Alpine package)
nodejs
Gentoo Linux
Fedora
Opensuse
nodejs (Alpine package)
nodejs
How to mitigate CVE-2018-7167
Update to version 10.4.1.
Node.js - update to 10.4.1
nodejs (Alpine package) - update to 8.11.3-r0
nodejs - addressed in versions 6.14.3-1.el7, 8.11.3-1.fc27, 8.11.3-1.fc28
nodejs (Alpine package) - update to 8.11.3-r0
nodejs - addressed in versions 6.14.3-1.el7, 8.11.3-1.fc27, 8.11.3-1.fc28