The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
References
Link | Resource |
---|---|
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html | Third Party Advisory |
http://rhn.redhat.com/errata/RHSA-2017-0002.html | |
http://www.securityfocus.com/bid/93191 | Third Party Advisory VDB Entry |
https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20b | Issue Tracking Patch |
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ | Patch Vendor Advisory |
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html | Third Party Advisory |
http://rhn.redhat.com/errata/RHSA-2017-0002.html | |
http://www.securityfocus.com/bid/93191 | Third Party Advisory VDB Entry |
https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20b | Issue Tracking Patch |
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
21 Nov 2024, 02:57
Type | Values Removed | Values Added |
---|---|---|
References | () http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html - Third Party Advisory | |
References | () http://rhn.redhat.com/errata/RHSA-2017-0002.html - | |
References | () http://www.securityfocus.com/bid/93191 - Third Party Advisory, VDB Entry | |
References | () https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20b - Issue Tracking, Patch | |
References | () https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ - Patch, Vendor Advisory |
Information
Published : 2016-10-10 16:59
Updated : 2024-11-21 02:57
NVD link : CVE-2016-7099
Mitre link : CVE-2016-7099
CVE.ORG link : CVE-2016-7099
JSON object : View
Products Affected
suse
- linux_enterprise
nodejs
- node.js
CWE
CWE-19
Data Processing Errors