CVE-2018-7162CWE-20

CVE-2018-7162

High · published June 13, 2018

CVSS v3.1
7.5
EPSS
7%
Percentile
93.9
In the wild
Unconfirmed
What it is

All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.06645 · 93.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-06-13T20:29Z
Affected products (2)
ProductVersionsFixed in
nodejs/node.js≥ 9.0.0, < 9.11.29.11.2
nodejs/node.js≥ 10.0.0, < 10.4.110.4.1
References (6)
http://www.securityfocus.com/bid/104468 · [email protected]https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ · [email protected]https://security.gentoo.org/glsa/202003-48 · [email protected]http://www.securityfocus.com/bid/104468 · af854a3a-2127-422b-91ae-364da2661108https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202003-48 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 13 JUN 16:00Z
    All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH
    cvelistv5