PT-2018-17923 · Node.Js · Node.Js

Jordan Zebor · Publicado 2018-06-13 · Atualizado 2022-08-16 · CVE-2018-7162

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Node.js versions 9.x through 10.x

Description The issue allows an attacker to cause a denial of service (DoS) by crashing a node process that provides an http server supporting TLS server. This can be accomplished by sending duplicate or unexpected messages during the handshake.

Recommendations For Node.js versions 9.x through 10.x, update the TLS implementation to address the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-7162

Produtos afetados

Node.Js

Referências · 7

• https://security-tracker.debian.org/tracker/CVE-2018-7162 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7162 · Nota de Segurança
• https://nodejs.org/en/blog/vulnerability/june-2018-security-releases · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-7162 · Aviso do Fabricante
• http://securityfocus.com/bid/104468 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7162 · Aviso do Fabricante
• https://security.gentoo.org/glsa/202003-48 · Aviso do Fabricante