The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-lts. | Aug 30, 2017 | Oct 10, 2016 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Oct 10, 2016 |
| Suse | — | Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-langUpgrade firefox-gtk3-dataUpgrade MozillaFirefox-branding-SLEDUpgrade libfreebl3Upgrade firefox-libffi7Upgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libcairo2Upgrade firefox-libffi4Upgrade mozilla-nspr-develUpgrade libsoftokn3Upgrade nodejs4-docsUpgrade mozilla-nspr-32bitUpgrade firefox-glib2-langUpgrade mozilla-nssUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-immodule-amharicUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-toolsUpgrade firefox-libgtk-3-0Upgrade libfirefox-gthread-2_0-0Upgrade MozillaFirefox-translations-commonUpgrade firefox-libharfbuzz0Upgrade nodejs8-develUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-thaiUpgrade libfreebl3-32bitUpgrade libfirefox-gio-2_0-0Upgrade libfirefox-gobject-2_0-0Upgrade firefox-libpango-1_0-0Upgrade libfirefox-glib-2_0-0Upgrade nodejs8Upgrade mozilla-nss-toolsUpgrade mozilla-nsprUpgrade npm4Upgrade mozilla-nss-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-atk-langUpgrade nodejs4Upgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs4-develUpgrade mozilla-nss-certsUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libcairo-gobject2Upgrade mozilla-nss-certs-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs8-docsUpgrade firefox-glib2-toolsUpgrade firefox-gio-branding-upstreamUpgrade npm8Upgrade MozillaFirefox | Oct 12, 2016 | Oct 6, 2016 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro) | Mar 22, 2023 | Oct 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub