Action not permitted
Modal body text goes here.
cve-2016-5325
Vulnerability from cvelistv5
Published
2016-10-10 16:00
Modified
2024-08-06 01:00
Severity ?
EPSS score ?
Summary
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T01:00:59.867Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762" }, { "name": "RHSA-2016:2101", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:2101" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/" }, { "name": "93483", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/93483" }, { "name": "GLSA-201612-43", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201612-43" }, { "name": "RHSA-2017:0002", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2017-0002.html" }, { "name": "SUSE-SU-2016:2470", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2016-09-27T00:00:00", "descriptions": [ { "lang": "en", "value": "CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2018-01-04T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762" }, { "name": "RHSA-2016:2101", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:2101" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/" }, { "name": "93483", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/93483" }, { "name": "GLSA-201612-43", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/201612-43" }, { "name": "RHSA-2017:0002", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2017-0002.html" }, { "name": "SUSE-SU-2016:2470", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-5325", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762", "refsource": "CONFIRM", "url": "https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762" }, { "name": "RHSA-2016:2101", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2016:2101" }, { "name": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/", "refsource": "CONFIRM", "url": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/" }, { "name": "93483", "refsource": "BID", "url": "http://www.securityfocus.com/bid/93483" }, { "name": "GLSA-201612-43", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201612-43" }, { "name": "RHSA-2017:0002", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2017-0002.html" }, { "name": "SUSE-SU-2016:2470", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-5325", "datePublished": "2016-10-10T16:00:00", "dateReserved": "2016-06-07T00:00:00", "dateUpdated": "2024-08-06T01:00:59.867Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2016-5325\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2016-10-10T16:59:00.200\",\"lastModified\":\"2018-01-05T02:31:00.980\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de inyecci\u00f3n CRLF en la funci\u00f3n ServerResponse#writeHead en Node.js 0.10.x en versiones anteriores a 0.10.47, 0.12.x en versiones anteriores a 0.12.16, 4.x en versiones anteriores a 4.6.0 y 6.x en versiones anteriores a 6.7.0 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de separaci\u00f3n de respuesta HTTP a trav\u00e9s del argumento de la raz\u00f3n.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-113\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0390D600-532D-4675-95BB-10EC4E06F3E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"35AAF7CD-9AE6-4A4B-858E-4B17031BD058\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DCB6010-AC31-4B61-9DA6-E119ADC5D70B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5364365-36F1-49C0-BF8D-2D5054BC7B1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0740684D-989A-4957-8AC1-AAB01A04E393\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"08C97202-6AEC-4B8D-B3F6-49F6AEF9CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EFA073A-9AC2-4162-9DDA-B6CD0AE53D3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F8FD4B3-D515-486A-94A3-29CBDA2E25CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55E18631-9502-42CC-A85A-EA5742FDC317\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CCBC213-1524-4C88-9EB3-52E003070A3B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C928FB55-2F33-4458-8484-4010AE8883A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CEEFA5F-2B32-4CA0-84AD-E0ECA0F81078\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4754B0A8-A7D7-41A1-BFE5-10D84E7CEC1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D132104E-163C-47EE-B247-578D64AC88D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E208FB1-A772-4002-BD56-3360BDDFEF37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14BE6C0B-E6EC-4CD2-912B-45DE9F94BA59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"714EBE27-F0D0-4B2E-90E1-4C73DF7FAA81\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.4.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BE8859F-1EBE-4B9A-A5ED-7FA63D68C947\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.4.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1249AA75-5676-4AFC-99B4-A59DC9BE1F33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.4.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E875B302-1923-40AF-B956-A063714BBA9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.4.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"10940F9C-6671-4C0D-89F9-6111A44FA74D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.4.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F031F09-0AF1-4825-8C8C-AC5A65119E92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:4.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"413C8F30-5B76-49D6-95C2-E62FC34911EC\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF2E637C-EA49-4DB6-B4D5-B4684A9549C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1966CED-11A1-4328-A57E-308BE5E4CCD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9F46AD2-BB74-4391-8A4F-7BE49EF41F0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC36E36A-9592-49DA-AACE-B3638FC55F4D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B98E9F42-08BC-49B5-90C8-AC3EA7960C45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ABA37EF5-DF97-467B-9A56-1611345387FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F0BD0C1-2294-4AFB-B4AE-C81576FB9AFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4057D560-81EE-49ED-888C-89560DBE3348\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F87810E1-BDAD-455D-82E3-334CC102AB2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8BC00B3A-3C9D-4487-9686-775CBAA1CC42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C0A4F5B-4546-414C-A209-07C27ED1C944\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2515087F-B272-4B76-99F4-ACA0C2460046\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C7016DE-A3A5-450B-9FBD-2C98A07FF3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C1848A7-E68E-4CB4-B73C-C5200ABAC9DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59F861AB-574A-41BF-8E2D-6440B35C2AA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41C8CEF8-49E1-4CB0-837B-E85C76BF9DF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7101A5-FDC9-4897-B8E8-6A07790D42A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.16-isaacs-manual:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7776F01-29AC-4161-9C91-C7392C6A356E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3CADD766-8328-4669-BE66-A4757D5FB471\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD9792E9-2593-46B4-9633-E2F2DB11106B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF209248-8921-419A-86EB-30E7095E4514\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C0D6C34-E046-40BD-907D-0E2510C09A14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5CBB83F-19AD-44BD-B7D4-19C1A8F80011\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6E2EA97-156D-4870-8967-78E4ED6EF64F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54961BCA-8730-4B40-8385-41F6D65797F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B22FA598-E613-4652-92CD-237F749D13DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4F321AF-FCC7-456D-AFE2-2CEF9CBAFCC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"18F2EC65-2A47-4C45-8D58-63D18443B767\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0517A28-70F9-4947-BEF0-9CC645388BFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5DD5BBD-922E-4026-9DEC-98CF9411CE95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63E078BA-8BDC-47EB-84B9-09B785FD1213\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B9971A7-1C18-43C0-97BC-27096609EFC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0EA5107B-4347-4D43-ADA6-141527A40333\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C679CFA-50D4-430B-B372-113CE236EACC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7AA6FEE-C630-4545-BCCF-3C211461C6C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"682E8A32-1F1E-4427-BAD8-58596F85F170\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9827EF0-E340-4A75-9735-F20CDF09CA42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6C02C09-D738-45B1-BF6F-A4499E5F8D60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE85CACC-842F-46C7-966D-48E866055A5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"771BCA5F-B762-4569-AB46-08A13A4EFD5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"21E05024-3647-456D-A731-D19411FED2DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89929EB1-D723-496B-A7C6-4B4CD9C176B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.41:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3EA4652-EF0E-414C-AEB8-AEFE788B66A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.42:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB746835-B498-4217-B909-69C597AD9431\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.43:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B759B4D1-90E2-4BB6-B38E-F7FBA7620B9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.44:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"898AD4C5-4B93-453D-AAE3-C04FE6486C19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.45:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87401457-F8C1-4372-8B71-694D2B35CCDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.10.46:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72552CF7-31C4-48D2-9028-03F71CEC9BEB\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBC8B78D-1131-4F21-919D-8AC79A410FB9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC9002F9-87C4-4C7F-9BD9-430EB15CD4BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"21EF734D-9E6B-4E01-9AFE-C0B847D583A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12606C39-6F39-4DDF-9B36-A160875B265F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC4D8789-33C3-498A-857D-CC6576732C31\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"466E8851-6BE7-4716-AB16-3E985411C35C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5C4DB21-F35A-4567-8B04-85DB3089CDF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA7E7436-117A-4F79-BA7A-2A0059BB9694\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"037511C2-3FA9-4A4C-996B-A1462C221DA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65EEB1B9-2E75-46F4-B70C-94991D38B427\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E5C5750-10F3-45D7-AC9B-7EA06F4B3887\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"75621360-0F11-42A1-95D5-5DC637DA81EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A46C3701-CD93-4F50-8307-998499B5909B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DCC0D52-5473-4794-BB66-4CA32FEC074D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"176B1165-2665-4541-9248-851996A22FCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5639B573-4A05-4F5E-BA10-9A3D757F0F8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:0.12.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6544D0F7-4026-4E2C-85D1-FEE9564E8022\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:6.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A53CB0E-3FBA-4796-BC81-6003A7DC29DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:6.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4F3F415-CD69-4E19-A4F9-3673D2907932\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:6.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"758E9981-966B-4BB5-8982-183683C76228\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:6.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD05686C-E548-43CB-81C1-5AE3E3E5ECBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:6.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D1FAA74-207E-4E37-90F7-75202ED64E37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:6.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F747352F-DFE4-45C3-9806-CBDC1E4A64E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:6.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E144BC9-0D69-4C9B-9AF0-D7730F1719EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:6.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"82EA5976-2268-4FF3-BE6A-5680D45073E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:6.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E85F98DB-A43D-47C0-B271-0E25DCF0EA65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:6.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94E82A49-5897-43D4-8EF7-F743B8B909E2\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0002.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/93483\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:2101\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201612-43\",\"source\":\"cve@mitre.org\"}]}}" } }
rhsa-2017_0002
Vulnerability from csaf_redhat
Published
2017-01-02 15:55
Modified
2024-11-14 20:51
Summary
Red Hat Security Advisory: rh-nodejs4-nodejs and rh-nodejs4-http-parser security update
Notes
Topic
An update for rh-nodejs4-nodejs and rh-nodejs4-http-parser is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.
The following packages have been upgraded to a newer upstream version: rh-nodejs4-nodejs (4.6.2), rh-nodejs4-http-parser (2.7.0). (BZ#1388097)
Security Fix(es):
* It was found that Node.js' tls.checkServerIdentity() function did not properly validate server certificates containing wildcards. A malicious TLS server could use this flaw to get a specially crafted certificate accepted by a Node.js TLS client. (CVE-2016-7099)
* It was found that the V8 Zone class was vulnerable to integer overflow when allocating new memory (Zone::New() and Zone::NewExpand()). An attacker with the ability to manipulate a large zone could crash the application or, potentially, execute arbitrary code with the application privileges. (CVE-2016-1669)
* A vulnerability was found in c-ares, a DNS resolver library bundled with Node.js. A hostname with an escaped trailing dot would have its size calculated incorrectly, leading to a single byte written beyond the end of a buffer on the heap. An attacker able to provide such a hostname to an application using c-ares, could potentially cause that application to crash. (CVE-2016-5180)
* It was found that the reason argument in ServerResponse#writeHead() was not properly validated. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted HTTP request. (CVE-2016-5325)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs4-nodejs and rh-nodejs4-http-parser is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a platform built on Chrome\u0027s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nThe following packages have been upgraded to a newer upstream version: rh-nodejs4-nodejs (4.6.2), rh-nodejs4-http-parser (2.7.0). (BZ#1388097)\n\nSecurity Fix(es):\n\n* It was found that Node.js\u0027 tls.checkServerIdentity() function did not properly validate server certificates containing wildcards. A malicious TLS server could use this flaw to get a specially crafted certificate accepted by a Node.js TLS client. (CVE-2016-7099)\n\n* It was found that the V8 Zone class was vulnerable to integer overflow when allocating new memory (Zone::New() and Zone::NewExpand()). An attacker with the ability to manipulate a large zone could crash the application or, potentially, execute arbitrary code with the application privileges. (CVE-2016-1669)\n\n* A vulnerability was found in c-ares, a DNS resolver library bundled with Node.js. A hostname with an escaped trailing dot would have its size calculated incorrectly, leading to a single byte written beyond the end of a buffer on the heap. An attacker able to provide such a hostname to an application using c-ares, could potentially cause that application to crash. (CVE-2016-5180)\n\n* It was found that the reason argument in ServerResponse#writeHead() was not properly validated. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted HTTP request. (CVE-2016-5325)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2017:0002", "url": "https://access.redhat.com/errata/RHSA-2017:0002" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1335449", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1335449" }, { "category": "external", "summary": "1346910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1346910" }, { "category": "external", "summary": "1379921", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1379921" }, { "category": "external", "summary": "1380463", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1380463" }, { "category": "external", "summary": "1388097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1388097" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0002.json" } ], "title": "Red Hat Security Advisory: rh-nodejs4-nodejs and rh-nodejs4-http-parser security update", "tracking": { "current_release_date": "2024-11-14T20:51:36+00:00", "generator": { "date": "2024-11-14T20:51:36+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2017:0002", "initial_release_date": "2017-01-02T15:55:58+00:00", "revision_history": [ { "date": "2017-01-02T15:55:58+00:00", "number": "1", "summary": "Initial version" }, { "date": "2017-01-02T15:55:58+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-14T20:51:36+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-RHSCL-2.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-RHSCL-2.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product_id": "6Server-RHSCL-2.3-6.7.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-2.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-2.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product_id": "7Server-RHSCL-2.3-7.2.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product_id": "7Server-RHSCL-2.3-7.3.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product_id": "7Server-RHSCL-2.2-7.1.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "product": { "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "product_id": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-nodejs-devel@4.6.2-4.el6?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "product": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "product_id": "rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-nodejs@4.6.2-4.el6?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "product": { "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "product_id": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-nodejs-debuginfo@4.6.2-4.el6?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "product": { "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "product_id": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-http-parser-devel@2.7.0-2.el6?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "product": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "product_id": "rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-http-parser@2.7.0-2.el6?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "product": { "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "product_id": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-http-parser-debuginfo@2.7.0-2.el6?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "product": { "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "product_id": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-nodejs-devel@4.6.2-4.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "product": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "product_id": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-nodejs@4.6.2-4.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "product": { "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "product_id": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-nodejs-debuginfo@4.6.2-4.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "product": { "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "product_id": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-http-parser-debuginfo@2.7.0-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "product": { "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "product_id": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-http-parser-devel@2.7.0-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "product": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "product_id": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-http-parser@2.7.0-2.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "product": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "product_id": "rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-nodejs@4.6.2-4.el6?arch=src" } } }, { "category": "product_version", "name": "rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "product": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "product_id": "rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-http-parser@2.7.0-2.el6?arch=src" } } }, { "category": "product_version", "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "product": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "product_id": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-nodejs@4.6.2-4.el7?arch=src" } } }, { "category": "product_version", "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "product": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "product_id": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-http-parser@2.7.0-2.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "product": { "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "product_id": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-nodejs-docs@4.6.2-4.el6?arch=noarch" } } }, { "category": "product_version", "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "product": { "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "product_id": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs4-nodejs-docs@4.6.2-4.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product_id": "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "relates_to_product_reference": "6Server-RHSCL-2.3-6.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product_id": "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3-6.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product_id": "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64" }, "product_reference": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3-6.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product_id": "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64" }, "product_reference": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3-6.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product_id": "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "relates_to_product_reference": "6Server-RHSCL-2.3-6.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product_id": "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3-6.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product_id": "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64" }, "product_reference": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3-6.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product_id": "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64" }, "product_reference": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3-6.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)", "product_id": "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch" }, "product_reference": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "relates_to_product_reference": "6Server-RHSCL-2.3-6.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "relates_to_product_reference": "6Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64" }, "product_reference": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64" }, "product_reference": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "relates_to_product_reference": "6Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64" }, "product_reference": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64" }, "product_reference": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "relates_to_product_reference": "6Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch" }, "product_reference": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "relates_to_product_reference": "6Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "relates_to_product_reference": "6Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "relates_to_product_reference": "6Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64" }, "product_reference": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "relates_to_product_reference": "6Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64" }, "product_reference": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "relates_to_product_reference": "6Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "relates_to_product_reference": "6Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "relates_to_product_reference": "6Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64" }, "product_reference": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "relates_to_product_reference": "6Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64" }, "product_reference": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "relates_to_product_reference": "6Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch" }, "product_reference": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "relates_to_product_reference": "6Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)", "product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" }, "product_reference": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product_id": "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-2.3-7.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product_id": "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product_id": "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product_id": "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product_id": "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "relates_to_product_reference": "7Server-RHSCL-2.3-7.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product_id": "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product_id": "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product_id": "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)", "product_id": "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" }, "product_reference": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-2.3-7.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product_id": "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-2.3-7.3.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product_id": "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.3.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product_id": "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.3.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product_id": "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.3.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product_id": "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "relates_to_product_reference": "7Server-RHSCL-2.3-7.3.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product_id": "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.3.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product_id": "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.3.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product_id": "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3-7.3.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)", "product_id": "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" }, "product_reference": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-2.3-7.3.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "relates_to_product_reference": "7Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" }, "product_reference": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64" }, "product_reference": "rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64" }, "product_reference": "rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-2.3" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" }, "product_reference": "rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-2.3" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-1669", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2016-05-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1335449" } ], "notes": [ { "category": "description", "text": "An integer-overflow flaw was found in V8\u0027s Zone class when allocating new memory (Zone::New() and Zone::NewExpand()). An attacker with the ability to manipulate a large zone could crash the application or, potentially, execute arbitrary code with the application privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "V8: integer overflow leading to buffer overflow in Zone::New", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-1669" }, { "category": "external", "summary": "RHBZ#1335449", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1335449" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-1669", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1669" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-1669", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1669" }, { "category": "external", "summary": "http://googlechromereleases.blogspot.com/2016/05/stable-channel-update.html", "url": "http://googlechromereleases.blogspot.com/2016/05/stable-channel-update.html" } ], "release_date": "2016-05-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2017-01-02T15:55:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2017:0002" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "V8: integer overflow leading to buffer overflow in Zone::New" }, { "cve": "CVE-2016-5180", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2016-09-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1380463" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in c-ares. A hostname with an escaped trailing dot (such as \"hello\\.\") would have its size calculated incorrectly, leading to a single byte written beyond the end of a buffer on the heap. An attacker able to provide such a hostname to an application using c-ares, could potentially cause that application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: Single byte out of buffer write", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-5180" }, { "category": "external", "summary": "RHBZ#1380463", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1380463" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-5180", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5180" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5180", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5180" }, { "category": "external", "summary": "https://c-ares.haxx.se/adv_20160929.html", "url": "https://c-ares.haxx.se/adv_20160929.html" } ], "release_date": "2016-09-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2017-01-02T15:55:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2017:0002" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: Single byte out of buffer write" }, { "cve": "CVE-2016-5325", "discovery_date": "2016-06-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1346910" } ], "notes": [ { "category": "description", "text": "It was found that the reason argument in ServerResponse#writeHead() was not properly validated. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted HTTP request.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: reason argument in ServerResponse#writeHead() not properly validated", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-5325" }, { "category": "external", "summary": "RHBZ#1346910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1346910" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-5325", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5325" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5325", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5325" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/" } ], "release_date": "2016-06-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2017-01-02T15:55:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2017:0002" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: reason argument in ServerResponse#writeHead() not properly validated" }, { "cve": "CVE-2016-7099", "discovery_date": "2016-09-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1379921" } ], "notes": [ { "category": "description", "text": "The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: wildcard certificates not properly validated", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-7099" }, { "category": "external", "summary": "RHBZ#1379921", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1379921" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-7099", "url": "https://www.cve.org/CVERecord?id=CVE-2016-7099" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7099", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7099" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/" } ], "release_date": "2016-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2017-01-02T15:55:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2017:0002" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3-6.7.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.src", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el6.x86_64", "6Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el6.noarch", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.2-7.1.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.2.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3-7.3.Z:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Server-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-debuginfo-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-http-parser-devel-0:2.7.0-2.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.src", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-debuginfo-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-devel-0:4.6.2-4.el7.x86_64", "7Workstation-RHSCL-2.3:rh-nodejs4-nodejs-docs-0:4.6.2-4.el7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nodejs: wildcard certificates not properly validated" } ] }
rhsa-2016_2101
Vulnerability from csaf_redhat
Published
2016-10-27 16:41
Modified
2024-11-14 20:49
Summary
Red Hat Security Advisory: nodejs and nodejs-tough-cookie security, bug fix, and enhancement update
Notes
Topic
An update for nodejs-tough-cookie and nodejs is now available for Red Hat
OpenShift Container Platform 3.1, 3.2, and 3.3.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is the company's cloud computing
Platform-as-a-Service (PaaS) solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* A regular expression denial of service flaw was found in Tough-Cookie. An
attacker able to make an application using Touch-Cookie to parse a
sufficiently large HTTP request Cookie header could cause the application
to consume an excessive amount of CPU. (CVE-2016-1000232)
* It was found that the reason argument in ServerResponse#writeHead() was
not properly validated. A remote attacker could possibly use this flaw to
conduct an HTTP response splitting attack via a specially-crafted HTTP
request. (CVE-2016-5325)
This advisory contains the RPM packages for this release. See the following
advisory for the container images fixes for this release:
https://access.redhat.com/errata/RHBA-2016:2100
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for nodejs-tough-cookie and nodejs is now available for Red Hat \nOpenShift Container Platform 3.1, 3.2, and 3.3.\n\nRed Hat Product Security has rated this update as having a security impact \nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which \ngives a detailed severity rating, is available for each vulnerability from \nthe CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is the company\u0027s cloud computing \nPlatform-as-a-Service (PaaS) solution designed for on-premise or private \ncloud deployments.\n\nSecurity Fix(es):\n\n* A regular expression denial of service flaw was found in Tough-Cookie. An \nattacker able to make an application using Touch-Cookie to parse a \nsufficiently large HTTP request Cookie header could cause the application \nto consume an excessive amount of CPU. (CVE-2016-1000232)\n\n* It was found that the reason argument in ServerResponse#writeHead() was \nnot properly validated. A remote attacker could possibly use this flaw to \nconduct an HTTP response splitting attack via a specially-crafted HTTP \nrequest. (CVE-2016-5325)\n\nThis advisory contains the RPM packages for this release. See the following\nadvisory for the container images fixes for this release:\n\nhttps://access.redhat.com/errata/RHBA-2016:2100", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2016:2101", "url": "https://access.redhat.com/errata/RHSA-2016:2101" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1346910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1346910" }, { "category": "external", "summary": "1359818", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1359818" }, { "category": "external", "summary": "1382854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1382854" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2101.json" } ], "title": "Red Hat Security Advisory: nodejs and nodejs-tough-cookie security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-14T20:49:19+00:00", "generator": { "date": "2024-11-14T20:49:19+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2016:2101", "initial_release_date": "2016-10-27T16:41:39+00:00", "revision_history": [ { "date": "2016-10-27T16:41:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2016-10-27T16:41:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-14T20:49:19+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 3.3", "product": { "name": "Red Hat OpenShift Container Platform 3.3", "product_id": "7Server-RH7-RHOSE-3.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.3::el7" } } }, { "category": "product_name", "name": "Red Hat OpenShift Container Platform 3.2", "product": { "name": "Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.2::el7" } } }, { "category": "product_name", "name": "Red Hat OpenShift Enterprise 3.1", "product": { "name": "Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.1::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "product": { "name": "nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "product_id": "nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-tough-cookie@2.3.1-1.el7?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-docs-0:0.10.47-2.el7.noarch", "product": { "name": "nodejs-docs-0:0.10.47-2.el7.noarch", "product_id": "nodejs-docs-0:0.10.47-2.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@0.10.47-2.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-tough-cookie-0:2.3.1-1.el7.src", "product": { "name": "nodejs-tough-cookie-0:2.3.1-1.el7.src", "product_id": "nodejs-tough-cookie-0:2.3.1-1.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-tough-cookie@2.3.1-1.el7?arch=src" } } }, { "category": "product_version", "name": "nodejs-0:0.10.47-2.el7.src", "product": { "name": "nodejs-0:0.10.47-2.el7.src", "product_id": "nodejs-0:0.10.47-2.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@0.10.47-2.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-devel-0:0.10.47-2.el7.x86_64", "product": { "name": "nodejs-devel-0:0.10.47-2.el7.x86_64", "product_id": "nodejs-devel-0:0.10.47-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@0.10.47-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "nodejs-0:0.10.47-2.el7.x86_64", "product": { "name": "nodejs-0:0.10.47-2.el7.x86_64", "product_id": "nodejs-0:0.10.47-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@0.10.47-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "product": { "name": "nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "product_id": "nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@0.10.47-2.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs-0:0.10.47-2.el7.src as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.src" }, "product_reference": "nodejs-0:0.10.47-2.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-0:0.10.47-2.el7.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.x86_64" }, "product_reference": "nodejs-0:0.10.47-2.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-0:0.10.47-2.el7.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:nodejs-debuginfo-0:0.10.47-2.el7.x86_64" }, "product_reference": "nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-0:0.10.47-2.el7.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:nodejs-devel-0:0.10.47-2.el7.x86_64" }, "product_reference": "nodejs-devel-0:0.10.47-2.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-0:0.10.47-2.el7.noarch as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:nodejs-docs-0:0.10.47-2.el7.noarch" }, "product_reference": "nodejs-docs-0:0.10.47-2.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-tough-cookie-0:2.3.1-1.el7.noarch as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.noarch" }, "product_reference": "nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-tough-cookie-0:2.3.1-1.el7.src as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.src" }, "product_reference": "nodejs-tough-cookie-0:2.3.1-1.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-0:0.10.47-2.el7.src as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.src" }, "product_reference": "nodejs-0:0.10.47-2.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-0:0.10.47-2.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.x86_64" }, "product_reference": "nodejs-0:0.10.47-2.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-0:0.10.47-2.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:nodejs-debuginfo-0:0.10.47-2.el7.x86_64" }, "product_reference": "nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-0:0.10.47-2.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:nodejs-devel-0:0.10.47-2.el7.x86_64" }, "product_reference": "nodejs-devel-0:0.10.47-2.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-0:0.10.47-2.el7.noarch as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:nodejs-docs-0:0.10.47-2.el7.noarch" }, "product_reference": "nodejs-docs-0:0.10.47-2.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-tough-cookie-0:2.3.1-1.el7.noarch as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.noarch" }, "product_reference": "nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-tough-cookie-0:2.3.1-1.el7.src as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.src" }, "product_reference": "nodejs-tough-cookie-0:2.3.1-1.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-0:0.10.47-2.el7.src as a component of Red Hat OpenShift Container Platform 3.3", "product_id": "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.src" }, "product_reference": "nodejs-0:0.10.47-2.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.3" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-0:0.10.47-2.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.3", "product_id": "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.x86_64" }, "product_reference": "nodejs-0:0.10.47-2.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.3" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-0:0.10.47-2.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.3", "product_id": "7Server-RH7-RHOSE-3.3:nodejs-debuginfo-0:0.10.47-2.el7.x86_64" }, "product_reference": "nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.3" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-0:0.10.47-2.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.3", "product_id": "7Server-RH7-RHOSE-3.3:nodejs-devel-0:0.10.47-2.el7.x86_64" }, "product_reference": "nodejs-devel-0:0.10.47-2.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.3" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-0:0.10.47-2.el7.noarch as a component of Red Hat OpenShift Container Platform 3.3", "product_id": "7Server-RH7-RHOSE-3.3:nodejs-docs-0:0.10.47-2.el7.noarch" }, "product_reference": "nodejs-docs-0:0.10.47-2.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.3" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-tough-cookie-0:2.3.1-1.el7.noarch as a component of Red Hat OpenShift Container Platform 3.3", "product_id": "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.noarch" }, "product_reference": "nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.3" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-tough-cookie-0:2.3.1-1.el7.src as a component of Red Hat OpenShift Container Platform 3.3", "product_id": "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.src" }, "product_reference": "nodejs-tough-cookie-0:2.3.1-1.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.3" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-5325", "discovery_date": "2016-06-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1346910" } ], "notes": [ { "category": "description", "text": "It was found that the reason argument in ServerResponse#writeHead() was not properly validated. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted HTTP request.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: reason argument in ServerResponse#writeHead() not properly validated", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-5325" }, { "category": "external", "summary": "RHBZ#1346910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1346910" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-5325", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5325" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5325", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5325" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/" } ], "release_date": "2016-06-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2016-10-27T16:41:39+00:00", "details": "For details on how to apply this update in OpenShift Container Platform 3, see the Solution section of the following advisory: \n\nhttps://access.redhat.com/errata/RHBA-2016:2100", "product_ids": [ "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2016:2101" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: reason argument in ServerResponse#writeHead() not properly validated" }, { "cve": "CVE-2016-1000232", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2016-07-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1359818" } ], "notes": [ { "category": "description", "text": "A regular expression denial of service flaw was found in Tough-Cookie. An attacker able to make an application using Touch-Cookie to parse an HTTP header with many semicolons could cause the application to consume an excessive amount of CPU.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-1000232" }, { "category": "external", "summary": "RHBZ#1359818", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1359818" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-1000232", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1000232" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000232", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000232" }, { "category": "external", "summary": "https://nodesecurity.io/advisories/130", "url": "https://nodesecurity.io/advisories/130" } ], "release_date": "2016-07-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2016-10-27T16:41:39+00:00", "details": "For details on how to apply this update in OpenShift Container Platform 3, see the Solution section of the following advisory: \n\nhttps://access.redhat.com/errata/RHBA-2016:2100", "product_ids": [ "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2016:2101" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.1:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.1:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.1:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.2:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-tough-cookie-0:2.3.1-1.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.src", "7Server-RH7-RHOSE-3.3:nodejs-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-debuginfo-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-devel-0:0.10.47-2.el7.x86_64", "7Server-RH7-RHOSE-3.3:nodejs-docs-0:0.10.47-2.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.noarch", "7Server-RH7-RHOSE-3.3:nodejs-tough-cookie-0:2.3.1-1.el7.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons" } ] }
gsd-2016-5325
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2016-5325", "description": "CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.", "id": "GSD-2016-5325", "references": [ "https://www.suse.com/security/cve/CVE-2016-5325.html", "https://access.redhat.com/errata/RHSA-2017:0002", "https://access.redhat.com/errata/RHSA-2016:2101", "https://advisories.mageia.org/CVE-2016-5325.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2016-5325" ], "details": "CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.", "id": "GSD-2016-5325", "modified": "2023-12-13T01:21:26.051842Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-5325", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762", "refsource": "CONFIRM", "url": "https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762" }, { "name": "RHSA-2016:2101", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2016:2101" }, { "name": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/", "refsource": "CONFIRM", "url": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/" }, { "name": "93483", "refsource": "BID", "url": "http://www.securityfocus.com/bid/93483" }, { "name": "GLSA-201612-43", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201612-43" }, { "name": "RHSA-2017:0002", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2017-0002.html" }, { "name": "SUSE-SU-2016:2470", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.4.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.4.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.2.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.2.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.2.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.4.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.4.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.2.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.2.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.3.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.4.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.4.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:4.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.42:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.43:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.36:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.35:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.28:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.27:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.20:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.46:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.39:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.38:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.37:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.24:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.17:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.16-isaacs-manual:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.29:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.22:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.21:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.16:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.15:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.44:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.45:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.41:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.40:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.26:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.25:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.19:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.18:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.10.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.15:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:0.12.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:6.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:6.5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:6.6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:6.2.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:6.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:6.3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:6.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:6.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:6.2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:6.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-5325" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-113" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762", "refsource": "CONFIRM", "tags": [ "Issue Tracking", "Patch" ], "url": "https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762" }, { "name": "SUSE-SU-2016:2470", "refsource": "SUSE", "tags": [ "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html" }, { "name": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/", "refsource": "CONFIRM", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/" }, { "name": "93483", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/93483" }, { "name": "GLSA-201612-43", "refsource": "GENTOO", "tags": [], "url": "https://security.gentoo.org/glsa/201612-43" }, { "name": "RHSA-2016:2101", "refsource": "REDHAT", "tags": [], "url": "https://access.redhat.com/errata/RHSA-2016:2101" }, { "name": "RHSA-2017:0002", "refsource": "REDHAT", "tags": [], "url": "http://rhn.redhat.com/errata/RHSA-2017-0002.html" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "exploitabilityScore": 2.8, "impactScore": 2.7 } }, "lastModifiedDate": "2018-01-05T02:31Z", "publishedDate": "2016-10-10T16:59Z" } } }
ghsa-qpf8-fqrf-8p2h
Vulnerability from github
Published
2022-05-14 03:56
Modified
2022-05-14 03:56
Severity ?
Details
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
{ "affected": [], "aliases": [ "CVE-2016-5325" ], "database_specific": { "cwe_ids": [ "CWE-113" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2016-10-10T16:59:00Z", "severity": "MODERATE" }, "details": "CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.", "id": "GHSA-qpf8-fqrf-8p2h", "modified": "2022-05-14T03:56:33Z", "published": "2022-05-14T03:56:33Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5325" }, { "type": "WEB", "url": "https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2016:2101" }, { "type": "WEB", "url": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/201612-43" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html" }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2017-0002.html" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/93483" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "type": "CVSS_V3" } ] }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.