CVE-2018-7159

🗓️ 17 May 2018 14:00:00Reported by nodejsType

The Node.js HTTP parser in all current versions ignores spaces in the `Content-Length` header, posing a potential risk to user-code

Reporter	Title	Published	Views	Family All 119
IBM Security Bulletins	Security Bulletin: IBM API Connect has addressed multiple vulnerabilities in Developer Portal's dependencies - Cumulative list from June 28, 2018 to December 13, 2018	28 Jan 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Local is affected by multiple Node.js vulnerabilities	13 Nov 201815:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Integration Bus & IBM App Connect Enterprise V11	20 Nov 201812:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is affected by multiple third-party vulnerabilities (Node.js, nghttp2, Linux, Intel CPU, Android)	31 Oct 201820:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private and IBM Cloud Private Cloud Foundry (CVE-2018-7158, CVE-2018-7159, CVE-2018-7160)	14 Sep 201821:30	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in IBM® SDK for Node.js™ affect IBM® SDK for Node.js™ in IBM Cloud (CVE-2018-7158, CVE-2018-7159, CVE-2018-7160)	9 Aug 201804:20	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and Business Process Manager (BPM)	15 Sep 202219:20	–	ibm
IBM Security Bulletins	Security Bulletin: Node.js as used in IBM QRadar Packet Capture is susceptible to multiple vulnerabilities	7 Nov 201815:25	–	ibm
FreeBSD	node.js -- multiple vulnerabilities	21 Mar 201800:00	–	freebsd
Tenable Nessus	Amazon Linux 2 : http-parser (ALAS-2019-1322)	25 Oct 201900:00	–	nessus

NVD

Node

nodejs node.jsRange4.0.0–4.1.2-

nodejs node.jsRange4.2.0–4.9.0lts

nodejs node.jsRange6.0.0–6.8.1-

nodejs node.jsRange6.9.0–6.14.0lts

nodejs node.jsRange8.0.0–8.8.1-

nodejs node.jsRange8.9.0–8.11.0lts

nodejs node.jsRange9.0.0–9.10.0-

[
  {
    "product": "Node.js",
    "vendor": "The Node.js Project",
    "versions": [
      {
        "status": "affected",
        "version": "4.x"
      },
      {
        "status": "affected",
        "version": "6.x"
      },
      {
        "status": "affected",
        "version": "8.x"
      },
      {
        "status": "affected",
        "version": "9.x"
      }
    ]
  }
]

Source	Link
access	www.access.redhat.com/errata/RHSA-2019:2258
support	www.support.f5.com/csp/article/K27228191
nodejs	www.nodejs.org/en/blog/vulnerability/march-2018-security-releases/

21 Nov 2024 04:11Current

6.2Medium risk

Vulners AI Score6.2

CVSS 25

CVSS 3.15.3

EPSS0.00902