Lucene search

K
cve[email protected]CVE-2018-12121
HistoryNov 28, 2018 - 5:29 p.m.

CVE-2018-12121

2018-11-2817:29:00
CWE-400
web.nvd.nist.gov
282
3
cve-2018-12121
node.js
http headers
denial of service
load balancer
proxy layer

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.014 Low

EPSS

Percentile

86.5%

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.

Affected configurations

NVD
Node
nodejsnode.jsRange6.0.0–6.15.0lts
OR
nodejsnode.jsRange8.0.0–8.14.0lts
OR
nodejsnode.jsRange10.0.0–10.14.0lts
OR
nodejsnode.jsRange11.0.0–11.3.0-
Node
redhatenterprise_linuxMatch8.0-
OR
redhatenterprise_linux_desktopMatch7.0
OR
redhatenterprise_linux_eusMatch8.1
OR
redhatenterprise_linux_eusMatch8.2
OR
redhatenterprise_linux_eusMatch8.4
OR
redhatenterprise_linux_eusMatch8.6
OR
redhatenterprise_linux_serverMatch7.0
OR
redhatenterprise_linux_server_ausMatch8.2
OR
redhatenterprise_linux_server_ausMatch8.4
OR
redhatenterprise_linux_server_ausMatch8.6
OR
redhatenterprise_linux_server_tusMatch8.2
OR
redhatenterprise_linux_server_tusMatch8.4
OR
redhatenterprise_linux_server_tusMatch8.6
OR
redhatenterprise_linux_workstationMatch7.0

CNA Affected

[
  {
    "product": "Node.js",
    "vendor": "The Node.js Project",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0"
      }
    ]
  }
]

Social References

More

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.014 Low

EPSS

Percentile

86.5%