Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 8 May 2012 10:43:15 +0200
From: Alex Legler <>
Subject: CVE request: node.js <0.6.17/0.7.8 HTTP server information disclosure


I didn't see a CVE/request for this one yet:

"A carefully crafted attack request can cause the contents of the HTTP 
parser’s buffer to be appended to the attacking request’s header, making it 
appear to come from the attacker. Since it is generally safe to echo back 
contents of a request, this can allow an attacker to get an otherwise 
correctly designed server to divulge information about other requests. It is 
theoretically possible that it could enable header-spoofing attacks, though 
such an attack has not been demonstrated."



Alex Legler <>
Gentoo Security/Ruby/Infrastructure

Download attachment "signature.asc " of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.