CVE-2018-12122CWE-400denial-of-service

CVE-2018-12122

High · published November 28, 2018

CVSS v3.1

7.5

EPSS

41%

Percentile

98.7

In the wild

Unconfirmed

What it is

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.41288 · 98.7th percentile
Weakness: CWE-400 · Uncontrolled Resource Consumption
Published: 2018-11-28T22:29Z

Affected products (9)

Product	Versions	Fixed in
nodejs/node.js	≥ 6.0.0, < 6.15.1	6.15.1
nodejs/node.js	≥ 8.0.0, < 8.14.0	8.14.0
nodejs/node.js	≥ 10.0.0, < 10.14.0	10.14.0
nodejs/node.js	≥ 11.0.0, < 11.3.0	11.3.0
suse/suse_enterprise_storage	all versions	—
suse/suse_linux_enterprise_server	all versions	—
suse/suse_linux_enterprise_server	all versions	—
suse/suse_openstack_cloud	all versions	—
suse/suse_openstack_cloud	all versions	—

References (9)

http://www.securityfocus.com/bid/106043 · [email protected]https://access.redhat.com/errata/RHSA-2019:1821 · [email protected]https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ · [email protected]https://security.gentoo.org/glsa/202003-48 · [email protected]http://www.securityfocus.com/bid/106043 · af854a3a-2127-422b-91ae-364da2661108 https://access.redhat.com/errata/RHSA-2019:1821 · af854a3a-2127-422b-91ae-364da2661108 https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ · af854a3a-2127-422b-91ae-364da2661108 https://security.gentoo.org/glsa/202003-48 · af854a3a-2127-422b-91ae-364da2661108 https://security.netapp.com/advisory/ntap-20241213-0009/ · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

28 NOV 17:00Z
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by…
cvelistv5