oss-security - CVE request: node.js <0.6.17/0.7.8 HTTP server information disclosure

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <201205081043.19357.a3li@gentoo.org>
Date: Tue, 8 May 2012 10:43:15 +0200
From: Alex Legler <a3li@...too.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: node.js <0.6.17/0.7.8 HTTP server information disclosure

Hi,

I didn't see a CVE/request for this one yet:

http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-
upgrade-to-0-6-17/

"A carefully crafted attack request can cause the contents of the HTTP 
parser’s buffer to be appended to the attacking request’s header, making it 
appear to come from the attacker. Since it is generally safe to echo back 
contents of a request, this can allow an attacker to get an otherwise 
correctly designed server to divulge information about other requests. It is 
theoretically possible that it could enable header-spoofing attacks, though 
such an attack has not been demonstrated."

Fix: https://github.com/joyent/node/commit/c9a231d

Thanks,
Alex

-- 
Alex Legler <a3li@...too.org>
Gentoo Security/Ruby/Infrastructure

Download attachment "signature.asc " of type "application/pgp-signature" (837 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.