Skip to content

Commit 071898d

Browse files
mattstern31mattstern31
committed
vuln/core: add known vulnerabilty JSON for node
PR-URL: nodejs/security-wg#35 Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
1 parent ffd4efc commit 071898d

41 files changed

Lines changed: 373 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎vuln/core/1.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"cve": [
3+
"CVE-2017-1000381"
4+
],
5+
"ref": "https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/",
6+
"vulnerable": "8.x || 7.x || 4.x || 6.x || 5.x",
7+
"patched": "^8.1.4 || ^7.10.1 || ^4.8.4 || ^6.11.1",
8+
"description": "memory overread when parsing invalid NAPTR responses",
9+
"overview": "The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR\nresponses, could be triggered to read memory outside of the given input buffer\nif the passed in DNS response packet was crafted in a particular way.\n\n"
10+
}

‎vuln/core/10.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"cve": [
3+
"CVE-2016-5172"
4+
],
5+
"vulnerable": "6.x",
6+
"patched": "^6.9.0",
7+
"ref": "https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/ for",
8+
"overview": "The V8 parser mishandled scopes, potentially allowing an attacker to obtain\nsensitive information from arbitrary memory locations via crafted JavaScript\ncode. This vulnerability would require an attacker to be able to execute\narbitrary JavaScript code in a Node.js process.\n\n"
9+
}

‎vuln/core/11.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"cve": [],
3+
"vulnerable": "6.x",
4+
"patched": "^6.9.0",
5+
"ref": "https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/ for",
6+
"author": "Jann Horn",
7+
"description": "unauthorized clients can easily access inspector port",
8+
"overview": "Generate a UUID for each execution of the inspector. This provides additional\nsecurity to prevent unauthorized clients from connecting to the Node.js process\nvia the v8_inspector port when running with `--inspect`. Since the debugging\nprotocol allows extensive access to the internals of a running process, and the\nexecution of arbitrary code, it is important to limit connections to authorized\ntools only.\n\n"
9+
}

‎vuln/core/12.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"cve": [
3+
"CVE-2016-6304"
4+
],
5+
"ref": "https://github.com/nodejs/node/pull/8714",
6+
"vulnerable": "6.x || 5.x || 4.x",
7+
"patched": "^6.7.0 || ^4.6.0",
8+
"description": "openssl 1.0.2h vulnerabilities",
9+
"overview": "A malicious client can exhaust a server's memory, resulting in a denial of\nservice (DoS) by sending very large OCSP Status Request extensions in a single\nsession.\n\nThis flaw is labelled high severity due to the ease of use for a DoS attack and\nNode.js servers using TLS are vulnerable.\n\n"
10+
}

‎vuln/core/13.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"cve": [
3+
"CVE-2016-2183"
4+
],
5+
"ref": "https://github.com/nodejs/node/pull/8714",
6+
"vulnerable": "6.x || 5.x || 4.x",
7+
"patched": "^6.7.0 || ^4.6.0",
8+
"description": "openssl 1.0.2h vulnerabilities",
9+
"overview": "SWEET32 is a new attack on older block cipher algorithms that use a block size\nof 64 bits.\n\nAs mitigation, OpenSSL has moved DES-based ciphers from the HIGH to MEDIUM\ngroup. As Node.js includes HIGH, but not MEDIUM, in its default suite, affected\nciphers are no longer included unless the default suite is not used. Node's\ndefault TLS cipher suite can be found in the API documentation.\n\n"
10+
}

‎vuln/core/14.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"cve": [
3+
"CVE-2016-6303"
4+
],
5+
"ref": "https://github.com/nodejs/node/pull/8714",
6+
"vulnerable": "6.x || 5.x || 4.x",
7+
"patched": "^6.7.0 || ^4.6.0",
8+
"description": "openssl 1.0.2h vulnerabilities",
9+
"overview": "An overflow can occur in MDC2_Update() under certain circumstances resulting in\nan out of bounds (OOB) error. This attack is impractical on most platforms due\nto the size of data required to trigger the OOB error.\n\nNode.js is impacted by this flaw but due to the impracticalities of exploiting\nit and the very low usage of of MDC-2, it is very low severity for Node.js\nusers.\n\n"
10+
}

‎vuln/core/15.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"cve": [
3+
"CVE-2016-2178"
4+
],
5+
"ref": "https://github.com/nodejs/node/pull/8714",
6+
"vulnerable": "6.x || 5.x || 4.x",
7+
"patched": "^6.7.0 || ^4.6.0",
8+
"description": "openssl 1.0.2h vulnerabilities",
9+
"overview": "A flaw in the OpenSSL DSA implementation means that a non-constant time codepath\nis followed for certain operations. This has been demonstrated through a\ncache-timing attack to be sufficient for an attacker to recover the private DSA\nkey.\n\nThis is very low severity for Node.js users due to the difficulty in taking\nadvantage of this attack and because DSA is very rarely used.\n\n"
10+
}

‎vuln/core/16.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"cve": [
3+
"CVE-2016-6306"
4+
],
5+
"ref": "https://github.com/nodejs/node/pull/8714",
6+
"vulnerable": "6.x || 5.x || 4.x",
7+
"patched": "^6.7.0 || ^4.6.0",
8+
"description": "openssl 1.0.2h vulnerabilities",
9+
"overview": "Some missing message length checks can result in out of bounds (OOB) reads of up\nto 2 bytes beyond an allocated buffer. There is a theoretical denial of service\n(DoS) risk. This only impacts a client or a server which enables client\nauthentication.\n\nNode.js is impacted by this low severity flaw.\n\n"
10+
}

‎vuln/core/17.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"cve": [],
3+
"ref": "https://github.com/nodejs/node-private/pull/73",
4+
"vulnerable": "6.x",
5+
"patched": "^6.7.0",
6+
"author": "Ahmed Zaki",
7+
"overview": "Remove support for loading dynamic third-party engine modules. An attacker\nmay be able to hide malicious code to be inserted into Node.js at runtime by\nmasquerading as one of the dynamic engine modules. Originally reported by\n\n"
8+
}

‎vuln/core/18.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"cve": [
3+
"CVE-2016-5325"
4+
],
5+
"ref": "https://github.com/nodejs/node-private/pull/60",
6+
"vulnerable": "6.x || 4.x || 5.x",
7+
"patched": "^6.7.0 || ^4.6.0",
8+
"author": "Romain Gaucher",
9+
"description": "HTTP processing security defect (CVE-2016-5325)",
10+
"cvss": "3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
11+
"cvss_score": "4.8 (Medium)",
12+
"overview": "**http**: Properly validate for allowable characters in the `reason` argument in\n`ServerResponse#writeHead()`. Fixes a possible response splitting attack vector.\nThis introduces a new case where `throw` may occur when configuring HTTP\nresponses, users should already be adopting try/catch here.\n\nThis is a low severity security defect that that may make HTTP response\nsplitting possible under certain circumstances. If user-input is passed to the\nreason argument to writeHead() on an HTTP response, a new-line character may be\nused to inject additional responses.\n\nThe fix for this defect introduces a new case where throw may occur when\nconfiguring HTTP responses. Users should already be adopting try/catch here.\n\nCommon Vulnerability Scoring System (CVSS) v3 Base Score:\n\n\tMetric\tScore\n\tBase Score:\t4.8 (Medium)\n\tBase Vector:\tCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\n\tAttack Vector:\tNetwork (AV:N)\n\tAttack Complexity:\tHigh (AC:H)\n\tPrivileges Required:\tNone (PR:N)\n\tUser Interaction:\tNone (UI:N)\n\tScope of Impact:\tUnchanged (S:U)\n\tConfidentiality Impact:\tLow (C:L)\n\tIntegrity Impact:\tLow (I:L)\n\tAvailability Impact:\tNone (A:N)\n\nRefer to the\n[CVSS v3 Specification](https://www.first.org/cvss/specification-document)\nfor details on the meanings and application of the vector components.\n\n"
13+
}

0 commit comments

Comments
 (0)