Resource exhaustion in Node.js - CVE-2018-12122
Published: November 29, 2018
Vulnerability identifier: #VU16169
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-12122
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to the socket is destroyed on the next received chunk when headers are not completely received within this period. A remote attacker can send headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time, consume excessive resources and cause the service to crash.
Affected software
Node.js
Gentoo Linux
Opensuse
IBM Cloud Transformation Advisor
nodejs-current (Alpine package)
rh-nodejs8-nodejs (Red Hat package)
Gentoo Linux
Opensuse
IBM Cloud Transformation Advisor
nodejs-current (Alpine package)
rh-nodejs8-nodejs (Red Hat package)
How to mitigate CVE-2018-12122
The vulnerability has been fixed in the versions 6.15.0, 8.14.0, 10.14.0, 11.3.0.
Node.js - addressed in versions 6.15.0, 8.14.0, 10.14.0, 11.3.0
IBM Cloud Transformation Advisor - update to 1.9.2
nodejs-current (Alpine package) - update to 11.3.0-r0
rh-nodejs8-nodejs (Red Hat package) - update to 8.16.0-1.el7
IBM Cloud Transformation Advisor - update to 1.9.2
nodejs-current (Alpine package) - update to 11.3.0-r0
rh-nodejs8-nodejs (Red Hat package) - update to 8.16.0-1.el7
External References
Related Security Bulletins
- Multiple vulnerabilities in Node.js
- OpenSUSE Linux update for nodejs4
- OpenSUSE Linux update for nodejs8
- OpenSUSE Linux update for nodejs6
- Gentoo update for Node.js
- Resource exhaustion in nodejs-current (Alpine package)
- Multiple vulnerabilities in IBM Cloud Transformation Advisor
- Red Hat Software Collections update for rh-nodejs8-nodejs