PT-2018-6043 · Hapi · Hapi

Geoand + 1 · Published 2018-06-04 · Updated 2019-10-09 · CVE-2017-16013

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: hapi versions 15.0.0 through 16.1.0

Description: The issue occurs when hapi encounters a malformed accept-encoding header, which may cause it to crash or hang the client connection until the timeout period is reached. Affected versions of hapi will crash or lock the event loop when such a header is received.

Recommendations: Update to version 16.1.1 or later.

Fix

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CVE-2017-16013

GHSA-CQJG-WHMM-8GV6

Affected Products

Hapi

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-16013 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16013 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cqjg-whmm-8gv6 · Vendor Advisory
• https://github.com/hapijs/hapi/issues/3466 · Note
• https://npmjs.com/advisories/335 · Note
• https://github.com/advisories/GHSA-cqjg-whmm-8gv6 · Note
• https://nodesecurity.io/advisories/335 · Note