CVE search · CVE-2016-5325
CVE-2016-5325
medium 6.1
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-113
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.0 | medium 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
References
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.securityfocus.com/bid/93483
- https://access.redhat.com/errata/RHSA-2016:2101
- https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762Issue TrackingPatch
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/PatchVendor Advisory
- https://security.gentoo.org/glsa/201612-43
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.securityfocus.com/bid/93483
- https://access.redhat.com/errata/RHSA-2016:2101
- https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762Issue TrackingPatch
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/PatchVendor Advisory
- https://security.gentoo.org/glsa/201612-43