Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 586084 (CVE-2016-5325) - <net-libs/nodejs-{0.12.17,4.6.0} : HTTP processing security defect (CVE-2016-5325)
Summary: <net-libs/nodejs-{0.12.17,4.6.0} : HTTP processing security defect (CVE-2016-...
Status: RESOLVED FIXED
Alias: CVE-2016-5325
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://nodejs.org/en/blog/vulnerabil...
Whiteboard: B3 [glsa cve]
Keywords:
Depends on: 585456 CVE-2016-7099
Blocks:
  Show dependency tree
 
Reported: 2016-06-16 08:17 UTC by Agostino Sarubbo
Modified: 2016-12-13 15:06 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-06-16 08:17:25 UTC 
From ${URL} :

An unspecified low-severity Node.js HTTP processing vulnerability was found and will be fixed in 
latest update. Details are currently embargoed until new releases are available.

External References:

https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2016-08-04 09:50:31 UTC 
Arch teams, please test and mark stable:
=net-libs/nodejs-4.4.6
Targeted stable KEYWORDS : amd64 x86
Comment 2 Agostino Sarubbo gentoo-dev 2016-08-07 10:46:13 UTC 
amd64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2016-09-29 09:07:09 UTC 
x86 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2016-11-11 12:41:19 UTC 
CVE-2016-5325 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5325):
  CRLF injection vulnerability in the ServerResponse#writeHead function in
  Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and
  6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers
  and conduct HTTP response splitting attacks via the reason argument.
Comment 5 Aaron Bauman (RETIRED) gentoo-dev 2016-11-11 12:42:51 UTC 
@maintainer(s), please clean the vulnerable versions from the tree.
Comment 6 Thomas Deutschmann (RETIRED) gentoo-dev 2016-12-12 20:19:47 UTC 
No vulnerable version, beside v0.12.x which will be handled via bug 595256, left in repository.
Comment 7 Aaron Bauman (RETIRED) gentoo-dev 2016-12-13 14:22:49 UTC 
Added to existing GLSA.
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2016-12-13 14:37:11 UTC 
This issue was resolved and addressed in
 GLSA 201612-43 at https://security.gentoo.org/glsa/201612-43
by GLSA coordinator Aaron Bauman (b-man).
Comment 9 Thomas Deutschmann (RETIRED) gentoo-dev 2016-12-13 15:06:05 UTC 
Summary was wrong, CVE-2016-5325 was finally fixed in 0.12.16 which never hit Gentoo repository. So most of this was handled via bug 595256 but all done now.