The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-lts. | Aug 30, 2017 | Oct 10, 2016 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Oct 10, 2016 |
| Suse | — | Upgrade nodejs8Upgrade mozilla-nss-certs-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade nodejs8-docsUpgrade firefox-gtk3-immodule-vietnameseUpgrade libfirefox-gio-2_0-0Upgrade nodejs4-develUpgrade libfreebl3-32bitUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozillafirefoxUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nss-32bitUpgrade mozilla-nss-develUpgrade firefox-gtk3-branding-upstreamUpgrade mozillafirefox-translations-otherUpgrade nodejs4Upgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libpango-1_0-0Upgrade firefox-gio-branding-upstreamUpgrade libfirefox-glib-2_0-0Upgrade firefox-glib2-toolsUpgrade npm8Upgrade firefox-atk-langUpgrade nodejs8-develUpgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nss-toolsUpgrade firefox-libcairo-gobject2Upgrade mozilla-nsprUpgrade npm4Upgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-amharicUpgrade mozillafirefox-translations-commonUpgrade libfreebl3Upgrade firefox-gtk3-dataUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libffi7Upgrade libsoftokn3-32bitUpgrade firefox-libcairo2Upgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodule-ximUpgrade mozilla-nssUpgrade mozillafirefox-branding-sledUpgrade firefox-gtk3-langUpgrade mozilla-nspr-develUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libffi4Upgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-toolsUpgrade libsoftokn3Upgrade nodejs4-docsUpgrade firefox-glib2-lang | Oct 12, 2016 | Oct 6, 2016 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro) | Mar 22, 2023 | Oct 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub