Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS
    handshake failure. The result was that an active network attacker could send application data to Node.js
    using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption. (CVE-2017-15896)

  - Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for
    the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not
    correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be
    initialized to all zeros in these cases. (CVE-2017-15897)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for     the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, This is not     correctly encoded, hex);' The buffer implementation was updated such that the buffer will be     initialized to all zeros in these cases. (CVE-2017-15897)

Note that Nessus relies on the presence of the package as reported by the vendor.

Node.js reports : Data Confidentiality/Integrity Vulnerability - CVE-2017-15896 Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption. Uninitialized buffer vulnerability - CVE-2017-15897 Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, 'This is not correctly encoded', 'hex');' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases. Also included in OpenSSL update - CVE 2017-3738 Note that CVE 2017-3738 of OpenSSL-1.0.2 affected Node but it was low severity.

ID	Name	Product	Family	Severity
424229	Alpine: multiple nodejs packages: security update to 8.9.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424229	Alpine: multiple nodejs packages: security update to 8.9.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
221048	Linux Distros Unpatched Vulnerability : CVE-2017-15897	Nessus	Misc.	low
405853	Alpine: multiple nodejs-current packages: security update to 9.2.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405853	Alpine: multiple nodejs-current packages: security update to 9.2.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405835	Alpine: nodejs: security update to 8.9.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405835	Alpine: nodejs: security update to 8.9.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
105259	FreeBSD : node.js -- Data Confidentiality/Integrity Vulnerability, December 2017 (bea84a7a-e0c9-11e7-b4f3-11baa0c2df21)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-15897

low

Tenable Plugins

critical

critical

low

critical

critical

critical

critical

critical