| Summary: | <net-libs/nodejs-{0.12.17,4.6.0} : HTTP processing security defect (CVE-2016-5325) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | bugs, jer, patrick, proxy-maint |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/ | ||
| Whiteboard: | B3 [glsa cve] | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | 585456, 595256 | ||
| Bug Blocks: | |||
Arch teams, please test and mark stable: =net-libs/nodejs-4.4.6 Targeted stable KEYWORDS : amd64 x86 amd64 stable x86 stable. Maintainer(s), please cleanup. Security, please vote. CVE-2016-5325 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5325): CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument. @maintainer(s), please clean the vulnerable versions from the tree. No vulnerable version, beside v0.12.x which will be handled via bug 595256, left in repository. Added to existing GLSA. This issue was resolved and addressed in GLSA 201612-43 at https://security.gentoo.org/glsa/201612-43 by GLSA coordinator Aaron Bauman (b-man). Summary was wrong, CVE-2016-5325 was finally fixed in 0.12.16 which never hit Gentoo repository. So most of this was handled via bug 595256 but all done now. |
From ${URL} : An unspecified low-severity Node.js HTTP processing vulnerability was found and will be fixed in latest update. Details are currently embargoed until new releases are available. External References: https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/ @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.