PT-2016-6364 · Node.Js+2 · Node.Js+2

Evan Lucas + 1 · Published 2016-10-05 · Updated 2020-01-17 · CVE-2016-5325

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Node.js versions 0.10.x through 0.10.46 Node.js versions 0.12.x through 0.12.15 Node.js versions 4.x through 4.5.0 Node.js versions 6.x through 6.6.0

Description A CRLF injection issue exists in the ServerResponse#writeHead function, allowing remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

Recommendations For Node.js versions 0.10.x through 0.10.46, update to version 0.10.47 or later. For Node.js versions 0.12.x through 0.12.15, update to version 0.12.16 or later. For Node.js versions 4.x through 4.5.0, update to version 4.6.0 or later. For Node.js versions 6.x through 6.6.0, update to version 6.7.0 or later.

Fix

Weakness Enumeration

CWE-113

Related Identifiers

ALT-PU-2016-2068

CVE-2016-5325

MGASA-2017-0204

OPENSUSE-SU-2016_2496-1

OPENSUSE-SU-2024:10247-1

RHSA-2016:2101

RHSA-2017:0002

SUSE-SU-2016:2470-1

SUSE-SU-2016:2470-2

SUSE-SU-2019:14246-1

SUSE-SU-2019_14246-1

Affected Products

Alt Linux

Node.Js

Suse

References · 256

• https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762 · Patch
• https://nodejs.org/en/blog/vulnerability/september-2016-security-releases · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5325 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5325 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0204 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-5325 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2470-2 · Vendor Advisory
• https://security.gentoo.org/glsa/201612-43 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5325 · Security Note
• https://access.redhat.com/errata/RHSA-2016:2101 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2470-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0204.html · Security Note