PT-2018-17923 · Node.Js · Node.Js

Jordan Zebor · Published 2018-06-13 · Updated 2022-08-16 · CVE-2018-7162

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Node.js versions 9.x through 10.x

Description The issue allows an attacker to cause a denial of service (DoS) by crashing a node process that provides an http server supporting TLS server. This can be accomplished by sending duplicate or unexpected messages during the handshake.

Recommendations For Node.js versions 9.x through 10.x, update the TLS implementation to address the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-7162

Affected Products

Node.Js

References · 7

• https://security-tracker.debian.org/tracker/CVE-2018-7162 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7162 · Security Note
• https://nodejs.org/en/blog/vulnerability/june-2018-security-releases · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7162 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7162 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-48 · Vendor Advisory
• http://securityfocus.com/bid/104468 · Note