PT-2018-17924 · Node.Js · Node.Js

CVE-2018-7164 · Publicado 2018-06-13 · Atualizado 2022-08-29

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Node.js versions 9.7.0 and later Node.js versions 10.x

Description A bug in Node.js increases memory consumption when reading from the network into JavaScript using the net.Socket object directly as a stream. This can be exploited by an attacker to cause a denial of service by sending small chunks of data in quick succession.

Recommendations For Node.js versions 9.7.0 and later, revert to the prior behavior to resolve the issue. For Node.js versions 10.x, revert to the prior behavior to resolve the issue.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2018-7164

Produtos afetados

Node.Js

Referências · 7

• http://securityfocus.com/bid/104463 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-7164 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-7164 · Aviso do Fabricante
• https://nodejs.org/en/blog/vulnerability/june-2018-security-releases · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7164 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7164 · Aviso do Fabricante
• https://security.gentoo.org/glsa/202003-48 · Aviso do Fabricante