PT-2017-14275 · Node.Js+1 · Node.Js+1

Published 2017-12-11 · Updated 2022-09-01 · CVE-2017-15897

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Node.js versions 8.X through 9.X

Description The issue arises when the encoding for the fill value does not match the encoding specified, causing buffers to not be initialized correctly. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex")' would be problematic. The buffer implementation was updated to initialize the buffer to all zeros in such cases.

Recommendations For Node.js versions 8.X through 9.X, update the buffer implementation to initialize buffers to all zeros when the encoding for the fill value does not match the encoding specified. As a temporary workaround, consider initializing buffers manually to all zeros in cases where encoding mismatches occur.

Exploit

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2017-15897

SUSE-SU-2019:14246-1

SUSE-SU-2019_14246-1

Affected Products

Node.Js

Suse

References · 493

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2016-5172.md · Exploit
• 🔥 https://github.com/ssllabs/openssl-ccs-cve-2014-0224 · Exploit
• 🔥 https://github.com/secretnonempty/CVE-2014-0224 · Exploit
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• https://bdu.fstec.ru/vul/2020-00598 · Security Note
• https://bdu.fstec.ru/vul/2022-02461 · Security Note
• https://bdu.fstec.ru/vul/2020-01827 · Security Note
• https://bdu.fstec.ru/vul/2020-00600 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15897 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02558 · Security Note
• https://bdu.fstec.ru/vul/2015-05855 · Security Note
• https://bdu.fstec.ru/vul/2015-05846 · Security Note
• https://bdu.fstec.ru/vul/2019-01911 · Security Note
• https://bdu.fstec.ru/vul/2015-07483 · Security Note
• https://bdu.fstec.ru/vul/2020-00596 · Security Note