Input validation error in Node.js - CVE-2017-15896
Published: December 11, 2017 / Updated: August 4, 2020
Vulnerability identifier: #VU33773
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15896
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.
Affected software
Node.js
nodejs-current (Alpine package)
nodejs-current (Alpine package)
How to mitigate CVE-2017-15896
Install update from vendor's website.
nodejs-current (Alpine package) - update to 9.2.1-r0