Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS
    handshake failure. The result was that an active network attacker could send application data to Node.js
    using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption. (CVE-2017-15896)

  - Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for
    the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not
    correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be
    initialized to all zeros in these cases. (CVE-2017-15897)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with
    1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a
    result of this defect would be very difficult to perform and are not believed likely. Attacks against
    DH1024 are considered just feasible, because most of the work necessary to deduce information about a
    private key may be performed offline. The amount of resources required for such an attack would be
    significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024
    private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects
    processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The
    impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version
    1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue
    we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h
    when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository.
    (CVE-2017-3738)

  - Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS
    handshake failure. The result was that an active network attacker could send application data to Node.js
    using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption. (CVE-2017-15896)

This update for nodejs6 fixes the following issues: Security issues fixed :

  - CVE-2017-15896: Vulnerable to CVE-2017-3737 due to     embedded OpenSSL (bsc#1072322).

  - CVE-2017-14919: Embedded zlib issue could cause a DoS     via specific windowBits value.

  - CVE-2017-3738: Embedded OpenSSL is vulnerable to     rsaz_1024_mul_avx2 overflow bug on x86_64.

  - CVE-2017-3736: Embedded OpenSSL is vulnerable to     bn_sqrx8x_internal carry bug on x86_64 (bsc#1066242).

  - CVE-2017-3735: Embedded OpenSSL is vulnerable to     malformed X.509 IPAdressFamily that could cause OOB read     (bsc#1056058). Bug fixes :

  - Update to LTS release 6.12.2 (bsc#1072322):
    https://nodejs.org/en/blog/vulnerability/december-2017-s     ecurity-releases/

  - https://nodejs.org/en/blog/release/v6.12.2/

  - https://nodejs.org/en/blog/release/v6.12.1/

  - https://nodejs.org/en/blog/release/v6.12.0/

  - https://nodejs.org/en/blog/release/v6.11.5/

  - https://nodejs.org/en/blog/release/v6.11.4/

  - https://nodejs.org/en/blog/release/v6.11.3/

  - https://nodejs.org/en/blog/release/v6.11.2/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 fixes the following issues: Security issues fixed :

  - CVE-2017-15896: Vulnerable to CVE-2017-3737 due to     embedded OpenSSL (bsc#1072322).

  - CVE-2017-14919: Embedded zlib issue could cause a DoS     via specific windowBits value.

  - CVE-2017-3738: Embedded OpenSSL is vulnerable to     rsaz_1024_mul_avx2 overflow bug on x86_64.

  - CVE-2017-3736: Embedded OpenSSL is vulnerable to     bn_sqrx8x_internal carry bug on x86_64 (bsc#1066242).

  - CVE-2017-3735: Embedded OpenSSL is vulnerable to     malformed X.509 IPAdressFamily that could cause OOB read     (bsc#1056058). Bug fixes :

  - Update to release 4.8.7 (bsc#1072322):
    https://nodejs.org/en/blog/vulnerability/december-2017-s     ecurity-releases/

  - https://nodejs.org/en/blog/release/v4.8.7/

  - https://nodejs.org/en/blog/release/v4.8.6/

  - https://nodejs.org/en/blog/release/v4.8.5/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs6 fixes the following issues :

Security issues fixed :

  - CVE-2017-15896: Vulnerable to CVE-2017-3737 due to     embedded OpenSSL (bsc#1072322).

  - CVE-2017-14919: Embedded zlib issue could cause a DoS     via specific windowBits value.

  - CVE-2017-3738: Embedded OpenSSL is vulnerable to     rsaz_1024_mul_avx2 overflow bug on x86_64.

  - CVE-2017-3736: Embedded OpenSSL is vulnerable to     bn_sqrx8x_internal carry bug on x86_64 (bsc#1066242).

  - CVE-2017-3735: Embedded OpenSSL is vulnerable to     malformed X.509 IPAdressFamily that could cause OOB read     (bsc#1056058).

Bug fixes :

  - Update to LTS release 6.12.2 (bsc#1072322) :

  - https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/

  - https://nodejs.org/en/blog/release/v6.12.2/

  - https://nodejs.org/en/blog/release/v6.12.1/

  - https://nodejs.org/en/blog/release/v6.12.0/

  - https://nodejs.org/en/blog/release/v6.11.5/

  - https://nodejs.org/en/blog/release/v6.11.4/

  - https://nodejs.org/en/blog/release/v6.11.3/

  - https://nodejs.org/en/blog/release/v6.11.2/

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs4 fixes the following issues :

Security issues fixed :

  - CVE-2017-15896: Vulnerable to CVE-2017-3737 due to     embedded OpenSSL (bsc#1072322).

  - CVE-2017-14919: Embedded zlib issue could cause a DoS     via specific windowBits value.

  - CVE-2017-3738: Embedded OpenSSL is vulnerable to     rsaz_1024_mul_avx2 overflow bug on x86_64.

  - CVE-2017-3736: Embedded OpenSSL is vulnerable to     bn_sqrx8x_internal carry bug on x86_64 (bsc#1066242).

  - CVE-2017-3735: Embedded OpenSSL is vulnerable to     malformed X.509 IPAdressFamily that could cause OOB read     (bsc#1056058).

Bug fixes :

  - Update to release 4.8.7 (bsc#1072322) :

  - https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/

  - https://nodejs.org/en/blog/release/v4.8.7/

  - https://nodejs.org/en/blog/release/v4.8.6/

  - https://nodejs.org/en/blog/release/v4.8.5/

This update was imported from the SUSE:SLE-12:Update update project.

Node.js reports : Data Confidentiality/Integrity Vulnerability - CVE-2017-15896 Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption. Uninitialized buffer vulnerability - CVE-2017-15897 Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, 'This is not correctly encoded', 'hex');' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases. Also included in OpenSSL update - CVE 2017-3738 Note that CVE 2017-3738 of OpenSSL-1.0.2 affected Node but it was low severity.

ID	Name	Product	Family	Severity
424229	Alpine: multiple nodejs packages: security update to 8.9.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424229	Alpine: multiple nodejs packages: security update to 8.9.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405853	Alpine: multiple nodejs-current packages: security update to 9.2.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405853	Alpine: multiple nodejs-current packages: security update to 9.2.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405835	Alpine: nodejs: security update to 8.9.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405835	Alpine: nodejs: security update to 8.9.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400788	Alpine: multiple nodejs packages: security update to 8.9.2-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400788	Alpine: multiple nodejs packages: security update to 8.9.2-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400784	Alpine: multiple nodejs-current packages: security update to 9.2.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400784	Alpine: multiple nodejs-current packages: security update to 9.2.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
120014	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2018:0293-1)	Nessus	SuSE Local Security Checks	critical
120012	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2018:0002-1)	Nessus	SuSE Local Security Checks	critical
106547	openSUSE Security Update : nodejs6 (openSUSE-2018-116)	Nessus	SuSE Local Security Checks	critical
105638	openSUSE Security Update : nodejs4 (openSUSE-2018-5)	Nessus	SuSE Local Security Checks	critical
105259	FreeBSD : node.js -- Data Confidentiality/Integrity Vulnerability, December 2017 (bea84a7a-e0c9-11e7-b4f3-11baa0c2df21)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-15896

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical