CVE-2016-7099

high-risk

Published 2016-10-10

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Do I need to act?

0.72% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.9/10 Medium

NETWORK / HIGH complexity

Affected Products (20)

Node.Js

Affected Vendors

Suse Nodejs

References (10)

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

http://rhn.redhat.com/errata/RHSA-2017-0002.html

Third Party Advisory http://www.securityfocus.com/bid/93191

Issue Tracking https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20b

Patch https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

http://rhn.redhat.com/errata/RHSA-2017-0002.html

Third Party Advisory http://www.securityfocus.com/bid/93191

Issue Tracking https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20b

Patch https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

/ 100

high-risk

Severity 18/34 · Moderate

Exploitability 2/34 · Minimal

Exposure 30/34 · Critical