CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
21 Nov 2024, 02:54
Type | Values Removed | Values Added |
---|---|---|
References | () http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html - Third Party Advisory | |
References | () http://rhn.redhat.com/errata/RHSA-2017-0002.html - | |
References | () http://www.securityfocus.com/bid/93483 - | |
References | () https://access.redhat.com/errata/RHSA-2016:2101 - | |
References | () https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762 - Issue Tracking, Patch | |
References | () https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ - Patch, Vendor Advisory | |
References | () https://security.gentoo.org/glsa/201612-43 - |
Information
Published : 2016-10-10 16:59
Updated : 2024-11-21 02:54
NVD link : CVE-2016-5325
Mitre link : CVE-2016-5325
CVE.ORG link : CVE-2016-5325
JSON object : View
Products Affected
suse
- linux_enterprise
nodejs
- node.js
CWE
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')