Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2949 advisory.

  - nodejs: HTTP parser allowed for spaces inside Content-Length header values (CVE-2018-7159)

  - nodejs: Inspector DNS rebinding vulnerability (CVE-2018-7160)

  - nodejs: denial of service (DoS) by causing a node server providing an http2 server to crash     (CVE-2018-7161)

  - nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters     (CVE-2018-7167)

  - nodejs: Out of bounds (OOB) write via UCS-2 encoding (CVE-2018-12115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4796-1 advisory.

  - The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before     4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which     allows man-in-the-middle attackers to spoof servers via a crafted certificate. (CVE-2016-7099)

  - The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be     triggered to read memory outside of the given input buffer if the passed in DNS response packet was     crafted in a particular way. (CVE-2017-1000381)

  - In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by     Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused     to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of     a buffer cause a miscalculation of the maximum length of the input bytes to be written. (CVE-2018-12115)

  - Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be     convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then     data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the     same server. (CVE-2018-12116)

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of     Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or     HTTPS connections and associated resources alive for a long period of time. (CVE-2018-12122)

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser     for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that     hostname can be spoofed by using a mixed case javascript: (e.g. javAscript:) protocol (other protocols     are not affected). If security decisions are made about the URL based on the hostname, they may be     incorrect. (CVE-2018-12123)

  - The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited     to perform remote code execution. An attack is possible from malicious websites open in a web browser on     the same computer, or another computer with network access to the computer running the Node.js process. A     malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy     checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process     with the debug port active is running on localhost or on a host on the local network, the malicious     website could connect to it as a debugger, and get full code execution access. (CVE-2018-7160)

  - Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a     Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and     Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of     Node.js 6.x (LTS Boron), 8.x (LTS Carbon), and 9.x are vulnerable. All versions of Node.js 10.x     (Current) are NOT vulnerable. (CVE-2018-7167)

  - In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1,     an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive     mode and by sending headers very slowly. This keeps the connection and associated resources alive for a     long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer.
    This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js     release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before     11.10.1. (CVE-2019-5737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K000137093 advisory.

  - Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a     Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and     Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of     Node.js 6.x (LTS Boron), 8.x (LTS Carbon), and 9.x are vulnerable. All versions of Node.js 10.x     (Current) are NOT vulnerable. (CVE-2018-7167)

  - In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by     Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused     to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of     a buffer cause a miscalculation of the maximum length of the input bytes to be written. (CVE-2018-12115)

  - Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be     convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then     data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the     same server. (CVE-2018-12116)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-48 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly write arbitrary files, cause a Denial       of Service condition or can conduct HTTP request splitting attacks.
  Workaround :

    There is no known workaround at this time.

This update for nodejs8 to version 8.11.3 fixes the following issues :

These security issues were fixed :

  - CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc()     with some parameters could have lead to a hang which     could have resulted in a DoS (bsc#1097375).

  - CVE-2018-7161: By interacting with the http2 server in a     manner that triggered a cleanup bug where objects are     used in native code after they are no longer available     an attacker could have caused a denial of service (DoS)     by causing a node server providing an http2 server to     crash (bsc#1097404).

  - CVE-2018-1000168: Fixed a denial of service     vulnerability by unbundling nghttp2 (bsc#1097401)

This update was imported from the SUSE:SLE-15:Update update project.

An update of the nodejs package has been released.

Update for security fixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs8 to version 8.11.3 fixes the following issues:
These security issues were fixed :

  - CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc()     with some parameters could have lead to a hang which     could have resulted in a DoS (bsc#1097375).

  - CVE-2018-7161: By interacting with the http2 server in a     manner that triggered a cleanup bug where objects are     used in native code after they are no longer available     an attacker could have caused a denial of service (DoS)     by causing a node server providing an http2 server to     crash (bsc#1097404).

  - CVE-2018-1000168: Fixed a denial of service     vulnerability by unbundling nghttp2 (bsc#1097401)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs6 to version 6.14.3 fixes the following issues:
The following security vulnerability was addressed :

  - Fixed a denial of service (DoS) vulnerability in     Buffer.fill(), which could hang when being called     (CVE-2018-7167, bsc#1097375). The following other     changes were made :

  - Use absolute paths in executable shebang lines

  - Fixed building with ICU61.1 (bsc#1091764)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Node.js installed on the remote host is 6.x prior to 6.14.3, 8.x prior to 8.11.3, 9.x prior to 9.11.2 or 10.x prior to 10.4.1. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs6 to version 6.14.3 fixes the following issues :

The following security vulnerability was addressed :

  - Fixed a denial of service (DoS) vulnerability in     Buffer.fill(), which could hang when being called     (CVE-2018-7167, bsc#1097375).

The following other changes were made :

  - Use absolute paths in executable shebang lines

  - Fixed building with ICU61.1 (bsc#1091764)

This update was imported from the SUSE:SLE-12:Update update project.

Node.js reports : Denial of Service Vulnerability in HTTP/2 (CVE-2018-7161) All versions of 8.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation. Thanks to Jordan Zebor at F5 Networks for reporting this issue. Denial of Service, nghttp2 dependency (CVE-2018-1000168) All versions of 9.x and later are vulnerable and the severity is HIGH. Under certain conditions, a malicious client can trigger an uninitialized read (and a subsequent segfault) by sending a malformed ALTSVC frame. This has been addressed through an by updating nghttp2. Denial of Service Vulnerability in TLS (CVE-2018-7162) All versions of 9.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation. Thanks to Jordan Zebor at F5 Networks all of his help investigating this issue with the Node.js team. Memory exhaustion DoS on v9.x (CVE-2018-7164) Versions 9.7.0 and later are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour. Calls to Buffer.fill() and/or Buffer.alloc() may hang (CVE-2018-7167) Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases.

ID	Name	Product	Family	Severity
194056	RHEL 7 : rh-nodejs8-nodejs (RHSA-2018:2949)	Nessus	Red Hat Local Security Checks	high
183156	Ubuntu 16.04 ESM / 18.04 ESM : Node.js vulnerabilities (USN-4796-1)	Nessus	Ubuntu Local Security Checks	high
182423	F5 Networks BIG-IP : Node.js vulnerabilities (K000137093)	Nessus	F5 Networks Local Security Checks	high
134776	GLSA-202003-48 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
123217	openSUSE Security Update : nodejs8 (openSUSE-2019-513)	Nessus	SuSE Local Security Checks	high
121994	Photon OS 2.0: Nodejs PHSA-2018-2.0-0093	Nessus	PhotonOS Local Security Checks	high
120914	Fedora 28 : 1:nodejs (2018-f59d961d7b)	Nessus	Fedora Local Security Checks	high
120038	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2018:1918-1)	Nessus	SuSE Local Security Checks	high
120036	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2018:1892-1)	Nessus	SuSE Local Security Checks	high
118957	Node.js multiple vulnerabilities (July 2018 Security Releases).	Nessus	Misc.	high
111095	openSUSE Security Update : nodejs8 (openSUSE-2018-724)	Nessus	SuSE Local Security Checks	high
111094	openSUSE Security Update : nodejs6 (openSUSE-2018-723)	Nessus	SuSE Local Security Checks	high
110822	Fedora 27 : 1:nodejs (2018-79841c871e)	Nessus	Fedora Local Security Checks	high
110539	FreeBSD : node.js -- multiple vulnerabilities (45b8e2eb-7056-11e8-8fab-63ca6e0e13a2)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-7167

high

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high

high

high

high