PT-2016-5010 · Node.Js+2 · Node.Js+2

Régis Leroy

·

Publicado

2016-02-19

·

Atualizado

2020-01-17

·

CVE-2016-2086

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Node.js versions 0.10.x through 0.10.41 Node.js versions 0.12.x through 0.12.9 Node.js versions 4.x through 4.2.0 Node.js versions 5.x through 5.5.0
Description The issue allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
Recommendations For Node.js versions 0.10.x through 0.10.41, update to version 0.10.42 or later. For Node.js versions 0.12.x through 0.12.9, update to version 0.12.10 or later. For Node.js versions 4.x through 4.2.0, update to version 4.3.0 or later. For Node.js versions 5.x through 5.5.0, update to version 5.6.0 or later.

Exploit

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2016-1328
CVE-2016-2086
MGASA-2016-0080
SUSE-SU-2019:14246-1
SUSE-SU-2019_14246-1

Produtos afetados

Alt Linux
Node.Js
Suse