CVE-2016-7099 The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certific...
MediumCVSS 5.9
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nodejs(Debian:12) | < 4.6.0~dfsg-1 | 4.6.0~dfsg-1 |
| debian/nodejs(Debian:13) | < 4.6.0~dfsg-1 | 4.6.0~dfsg-1 |
| debian/nodejs(Debian:14) | < 4.6.0~dfsg-1 | 4.6.0~dfsg-1 |
| nodejs node.js | = 0.10.0 | No fix listed |
| nodejs node.js | = 0.10.1 | No fix listed |
| nodejs node.js | = 0.10.2 | No fix listed |
| nodejs node.js | = 0.10.3 | No fix listed |
| nodejs node.js | = 0.10.4 | No fix listed |
| nodejs node.js | = 0.10.5 | No fix listed |
| nodejs node.js | = 0.10.6 | No fix listed |
| nodejs node.js | = 0.10.7 | No fix listed |
| nodejs node.js | = 0.10.8 | No fix listed |
| nodejs node.js | = 0.10.9 | No fix listed |
| nodejs node.js | = 0.10.10 | No fix listed |
| nodejs node.js | = 0.10.11 | No fix listed |
| nodejs node.js | = 0.10.12 | No fix listed |
| nodejs node.js | = 0.10.13 | No fix listed |
| nodejs node.js | = 0.10.14 | No fix listed |
| nodejs node.js | = 0.10.15 | No fix listed |
| nodejs node.js | = 0.10.16 | No fix listed |
| nodejs node.js | = 0.10.16-isaacs-manual | No fix listed |
| nodejs node.js | = 0.10.17 | No fix listed |
| nodejs node.js | = 0.10.18 | No fix listed |
| nodejs node.js | = 0.10.19 | No fix listed |
| nodejs node.js | = 0.10.20 | No fix listed |
Show 76 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs node.js | = 0.10.21 | No fix listed |
| nodejs node.js | = 0.10.22 | No fix listed |
| nodejs node.js | = 0.10.23 | No fix listed |
| nodejs node.js | = 0.10.24 | No fix listed |
| nodejs node.js | = 0.10.25 | No fix listed |
| nodejs node.js | = 0.10.26 | No fix listed |
| nodejs node.js | = 0.10.27 | No fix listed |
| nodejs node.js | = 0.10.28 | No fix listed |
| nodejs node.js | = 0.10.29 | No fix listed |
| nodejs node.js | = 0.10.30 | No fix listed |
| nodejs node.js | = 0.10.31 | No fix listed |
| nodejs node.js | = 0.10.32 | No fix listed |
| nodejs node.js | = 0.10.33 | No fix listed |
| nodejs node.js | = 0.10.34 | No fix listed |
| nodejs node.js | = 0.10.35 | No fix listed |
| nodejs node.js | = 0.10.36 | No fix listed |
| nodejs node.js | = 0.10.37 | No fix listed |
| nodejs node.js | = 0.10.38 | No fix listed |
| nodejs node.js | = 0.10.39 | No fix listed |
| nodejs node.js | = 0.10.40 | No fix listed |
| nodejs node.js | = 0.10.41 | No fix listed |
| nodejs node.js | = 0.10.42 | No fix listed |
| nodejs node.js | = 0.10.43 | No fix listed |
| nodejs node.js | = 0.10.44 | No fix listed |
| nodejs node.js | = 0.10.45 | No fix listed |
| nodejs node.js | = 0.10.46 | No fix listed |
| nodejs node.js | = 6.0.0 | No fix listed |
| nodejs node.js | = 6.1.0 | No fix listed |
| nodejs node.js | = 6.2.0 | No fix listed |
| nodejs node.js | = 6.2.1 | No fix listed |
| nodejs node.js | = 6.2.2 | No fix listed |
| nodejs node.js | = 6.3.0 | No fix listed |
| nodejs node.js | = 6.3.1 | No fix listed |
| nodejs node.js | = 6.4.0 | No fix listed |
| nodejs node.js | = 6.5.0 | No fix listed |
| nodejs node.js | = 6.6.0 | No fix listed |
| nodejs node.js | = 0.12.0 | No fix listed |
| nodejs node.js | = 0.12.1 | No fix listed |
| nodejs node.js | = 0.12.2 | No fix listed |
| nodejs node.js | = 0.12.3 | No fix listed |
| nodejs node.js | = 0.12.4 | No fix listed |
| nodejs node.js | = 0.12.5 | No fix listed |
| nodejs node.js | = 0.12.6 | No fix listed |
| nodejs node.js | = 0.12.7 | No fix listed |
| nodejs node.js | = 0.12.8 | No fix listed |
| nodejs node.js | = 0.12.9 | No fix listed |
| nodejs node.js | = 0.12.10 | No fix listed |
| nodejs node.js | = 0.12.11 | No fix listed |
| nodejs node.js | = 0.12.12 | No fix listed |
| nodejs node.js | = 0.12.13 | No fix listed |
| nodejs node.js | = 0.12.14 | No fix listed |
| nodejs node.js | = 0.12.15 | No fix listed |
| nodejs node.js | = 4.0.0 | No fix listed |
| nodejs node.js | = 4.1.0 | No fix listed |
| nodejs node.js | = 4.1.1 | No fix listed |
| nodejs node.js | = 4.1.2 | No fix listed |
| nodejs node.js | = 4.2.0 | No fix listed |
| nodejs node.js | = 4.2.1 | No fix listed |
| nodejs node.js | = 4.2.2 | No fix listed |
| nodejs node.js | = 4.2.3 | No fix listed |
| nodejs node.js | = 4.2.4 | No fix listed |
| nodejs node.js | = 4.2.5 | No fix listed |
| nodejs node.js | = 4.2.6 | No fix listed |
| nodejs node.js | = 4.3.0 | No fix listed |
| nodejs node.js | = 4.3.1 | No fix listed |
| nodejs node.js | = 4.3.2 | No fix listed |
| nodejs node.js | = 4.4.0 | No fix listed |
| nodejs node.js | = 4.4.1 | No fix listed |
| nodejs node.js | = 4.4.2 | No fix listed |
| nodejs node.js | = 4.4.3 | No fix listed |
| nodejs node.js | = 4.4.4 | No fix listed |
| nodejs node.js | = 4.4.5 | No fix listed |
| nodejs node.js | = 4.4.6 | No fix listed |
| nodejs node.js | = 4.4.7 | No fix listed |
| nodejs node.js | = 4.5.0 | No fix listed |
| SUSE linux enterprise | = 12.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-7099 vendor-advisory
- SUSE-SU-2016:2470 third-party-advisory vendor-advisory
- RHSA-2017:0002 vendor-advisory
- 93191 third-party-advisory vdb-entry
- github.com issue-tracking patch
- nodejs.org patch vendor-advisory
- bugs.debian.org issue-tracking