Summary: | <net-libs/nodejs-{0.12.17,4.6.0} : HTTP processing security defect (CVE-2016-5325) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | bugs, jer, patrick, proxy-maint |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/ | ||
Whiteboard: | B3 [glsa cve] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | 585456, 595256 | ||
Bug Blocks: |
Description
Agostino Sarubbo
2016-06-16 08:17:25 UTC
Arch teams, please test and mark stable: =net-libs/nodejs-4.4.6 Targeted stable KEYWORDS : amd64 x86 amd64 stable x86 stable. Maintainer(s), please cleanup. Security, please vote. CVE-2016-5325 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5325): CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument. @maintainer(s), please clean the vulnerable versions from the tree. No vulnerable version, beside v0.12.x which will be handled via bug 595256, left in repository. Added to existing GLSA. This issue was resolved and addressed in GLSA 201612-43 at https://security.gentoo.org/glsa/201612-43 by GLSA coordinator Aaron Bauman (b-man). Summary was wrong, CVE-2016-5325 was finally fixed in 0.12.16 which never hit Gentoo repository. So most of this was handled via bug 595256 but all done now. |