CVE-2012-2330 The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information...
MediumCVSS 6.4
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nodejs(Debian:12) | < 0.6.17~dfsg1-1 | 0.6.17~dfsg1-1 |
| debian/nodejs(Debian:13) | < 0.6.17~dfsg1-1 | 0.6.17~dfsg1-1 |
| debian/nodejs(Debian:14) | < 0.6.17~dfsg1-1 | 0.6.17~dfsg1-1 |
| nodejs | <= 0.6.16 | No fix listed |
| nodejs | = 0.7.0 | No fix listed |
| nodejs | = 0.7.1 | No fix listed |
| nodejs | = 0.7.2 | No fix listed |
| nodejs | = 0.7.3 | No fix listed |
| nodejs | = 0.7.4 | No fix listed |
| nodejs | = 0.7.5 | No fix listed |
| nodejs | = 0.7.6 | No fix listed |
| nodejs | = 0.7.7 | No fix listed |
References
- Debian Security Tracker CVE-2012-2330 vendor-advisory
- blog.nodejs.org
- 49066 third-party-advisory vendor-advisory
- [oss-security] 20120508 CVE request: node.js <0.6.17/0.7.8 HTTP server information disclosure mailing-list
- [oss-security] 20120508 Re: CVE request: node.js <0.6.17/0.7.8 HTTP server information disclosure mailing-list
- github.com exploit patch
- github.com exploit patch
- support.f5.com