medium5.9
CVE-2016-7099
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle w…
Impact
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodejs | Node.Js | Versions 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5 |
| Suse | Linux Enterprise | Version 12.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.securityfocus.com/bid/93191
- https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20b
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.securityfocus.com/bid/93191
- https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20b
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/