Date: Tue, 8 May 2012 10:43:15 +0200 From: Alex Legler <a3li@...too.org> To: oss-security@...ts.openwall.com Subject: CVE request: node.js <0.6.17/0.7.8 HTTP server information disclosure Hi, I didn't see a CVE/request for this one yet: http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please- upgrade-to-0-6-17/ "A carefully crafted attack request can cause the contents of the HTTP parser’s buffer to be appended to the attacking request’s header, making it appear to come from the attacker. Since it is generally safe to echo back contents of a request, this can allow an attacker to get an otherwise correctly designed server to divulge information about other requests. It is theoretically possible that it could enable header-spoofing attacks, though such an attack has not been demonstrated." Fix: https://github.com/joyent/node/commit/c9a231d Thanks, Alex -- Alex Legler <a3li@...too.org> Gentoo Security/Ruby/Infrastructure Download attachment "signature.asc " of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.