CVE search · CVE-2016-7099
CVE-2016-7099
medium 5.9
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-19
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.0 | medium 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
References
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.securityfocus.com/bid/93191Third Party AdvisoryVDB Entry
- https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20bIssue TrackingPatch
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/PatchVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.securityfocus.com/bid/93191Third Party AdvisoryVDB Entry
- https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20bIssue TrackingPatch
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/PatchVendor Advisory