HighFix available
Security updates for all active release lines, July 2017
Node.js issued security updates for its active release lines and 7.x, addressing Node.js vulnerabilities and fixes in dependencies. The announcement recommends upgrading affected release lines.
Announced Source revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for all active Node.js release lines as well as the 7.x line.
Node.js
Node.js-specific security flaws
- Affected versions
- 4.x
This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line.
6.xThis is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line.
7.xThis is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line.
8.xThis is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line.
0.10.xThe 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability.
0.12.xThe 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability.
- Fixed versions
- 8.3.0
The vulnerability has been patched upstream and snapshots have been re-enabled in 8.3.0
- Prerequisites
- Not stated in this extraction
Node.js
Node.js-specific security flaws
- Affected versions
- 4.x
This is a low severity defect and only applies to the 4.x release line.
- Fixed versions
- Not stated in this extraction
- Prerequisites
- the auth field of the options object used with http.get() to be set to a number
Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string.
c-ares
CVE-2017-1000381 - c-ares NAPTR parser out of bounds access
- Affected versions
- all versions of Node.js
A security vulnerability has been discovered in the c-ares library that is bundled with all versions of Node.js.
- Fixed versions
- Not stated in this extraction
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2017-11499
Constant Hashtable Seeds (CVE-2017-11499)
CVE-2017-1000381CVE-2017-1000381 - c-ares NAPTR parser out of bounds access
Publisher severity
high
This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line.
- Event
- #58109 · Revision 1
- Added to Heist Feed
- Publisher date