Red Hat Security AdvisoryRHSA-2016:2101
nodejs and nodejs-tough-cookie security, bug fix, and enhancement update
Released 2016-10-27 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 3.2 nodejs-0.10.47-2.el7, nodejs-devel-0.10.47-2.el7, nodejs-docs-0.10.47-2.el7 +1
- Red Hat OpenShift Container Platform 3.3 nodejs-0.10.47-2.el7, nodejs-devel-0.10.47-2.el7, nodejs-docs-0.10.47-2.el7 +1
- Red Hat OpenShift Enterprise 3.1 nodejs-0.10.47-2.el7, nodejs-devel-0.10.47-2.el7, nodejs-docs-0.10.47-2.el7 +1
Fixes 2 records
Priority LOW 34
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP heade…
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.04093 · Published 2016-10-10 · Partial fix CWE-113
Priority LOW 29
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02356 · Published 2018-09-05 · Partial fix · 2.3.0 CWE-20
