The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-lts. | Aug 30, 2017 | Oct 10, 2016 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Oct 10, 2016 |
| Suse | — | Upgrade libfirefox-glib-2_0-0Upgrade mozillafirefoxUpgrade mozilla-nss-32bitUpgrade mozilla-nss-certsUpgrade firefox-atk-langUpgrade mozillafirefox-translations-otherUpgrade firefox-gdk-pixbuf-langUpgrade firefox-glib2-toolsUpgrade firefox-gio-branding-upstreamUpgrade libfirefox-gobject-2_0-0Upgrade npm8Upgrade firefox-libpango-1_0-0Upgrade mozilla-nss-toolsUpgrade mozilla-nsprUpgrade npm4Upgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-thaiUpgrade nodejs8-docsUpgrade nodejs8-develUpgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-libcairo-gobject2Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade nodejs8Upgrade firefox-gtk3-immodule-vietnameseUpgrade libfreebl3-32bitUpgrade nodejs4Upgrade libfirefox-gio-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs4-develUpgrade mozilla-nssUpgrade libfreebl3Upgrade firefox-libffi7Upgrade firefox-libffi4Upgrade firefox-libharfbuzz0Upgrade mozillafirefox-branding-sledUpgrade firefox-gtk3-langUpgrade firefox-libatk-1_0-0Upgrade mozillafirefox-translations-commonUpgrade libsoftokn3Upgrade nodejs4-docsUpgrade firefox-libgtk-3-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-dataUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gthread-2_0-0Upgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-glib2-langUpgrade firefox-libcairo2Upgrade firefox-gtk3-tools | Oct 12, 2016 | Oct 6, 2016 |
| Ubuntu | — | Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro) | Mar 22, 2023 | Oct 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub