Input validation error in Node.js - CVE-2017-11499
Published: July 25, 2017 / Updated: August 8, 2020
Vulnerability identifier: #VU38646
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-11499
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup.
Affected software
Node.js
Fedora
nodejs
rh-nodejs6-nodejs (Red Hat package)
Fedora
nodejs
rh-nodejs6-nodejs (Red Hat package)
How to mitigate CVE-2017-11499
Install update from vendor's website.
nodejs - update to 6.11.1-1.el7
rh-nodejs6-nodejs (Red Hat package) - addressed in versions 6.11.3-2.el6, 6.11.3-2.el7
rh-nodejs6-nodejs (Red Hat package) - addressed in versions 6.11.3-2.el6, 6.11.3-2.el7