CVE-2018-12116
Published: 28 November 2018
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
From the Ubuntu Security Team
Arkadiy Tetelman discovered that Node.js improperly handled certain malformed HTTP requests. An attacker could use this vulnerability to inject unexpected HTTP requests.
Priority
Status
Package | Release | Status |
---|---|---|
nodejs Launchpad, Ubuntu, Debian |
bionic |
Released
(8.10.0~dfsg-2ubuntu0.4+esm1)
Available with Ubuntu Pro |
cosmic |
Ignored
(end of life)
|
|
disco |
Not vulnerable
(10.15.1~dfsg-5)
|
|
eoan |
Not vulnerable
(10.15.1~dfsg-5)
|
|
focal |
Not vulnerable
(10.15.1~dfsg-5)
|
|
groovy |
Not vulnerable
(10.15.1~dfsg-5)
|
|
hirsute |
Not vulnerable
(10.15.1~dfsg-5)
|
|
impish |
Not vulnerable
(10.15.1~dfsg-5)
|
|
jammy |
Not vulnerable
(10.15.1~dfsg-5)
|
|
kinetic |
Not vulnerable
(10.15.1~dfsg-5)
|
|
lunar |
Not vulnerable
(10.15.1~dfsg-5)
|
|
trusty |
Not vulnerable
(code not present)
|
|
upstream |
Released
(8.14.0)
|
|
xenial |
Not vulnerable
(code not present)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | High |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |