PT-2017-12053 · Node.Js+2 · Node.Js+2

Jann Horn

·

Published

2017-07-25

·

Updated

2021-07-28

·

CVE-2017-11499

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Node.js versions 4.0 through 4.8.3 Node.js versions 5.x Node.js versions 6.0 through 6.11.0 Node.js versions 7.0 through 7.10.0 Node.js versions 8.0 through 8.1.3
Description The issue allows for hash flooding remote Denial of Service (DoS) attacks due to the constant HashTable seed across a given released version of Node.js. This is caused by building with V8 snapshots enabled by default, which overwrites the initially randomized seed on startup.
Recommendations For Node.js versions 4.0 through 4.8.3, update to a version outside of this range to resolve the issue. For Node.js versions 5.x, update to a version outside of this range to resolve the issue. For Node.js versions 6.0 through 6.11.0, update to a version outside of this range to resolve the issue. For Node.js versions 7.0 through 7.10.0, update to a version outside of this range to resolve the issue. For Node.js versions 8.0 through 8.1.3, update to a version outside of this range to resolve the issue.

Exploit

Fix

DoS

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2017-2389
CVE-2017-11499
RHSA-2017:2908
RHSA-2017:3002
SUSE-SU-2017:2168-1
SUSE-SU-2019:14246-1
SUSE-SU-2019_14246-1
SUSE-SU-2021:1962-1
SUSE-SU-2021:1963-1
SUSE-SU-2021:2554-1

Affected Products

Alt Linux
Node.Js
Suse