CVE-2016-7099

Related Files

Red Hat Security Advisory 2017-0002-01

Posted Jan 3, 2017

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-0002-01 - Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. The following packages have been upgraded to a newer upstream version: rh-nodejs4-nodejs, rh-nodejs4-http-parser. Security Fix: It was found that Node.js' tls.checkServerIdentity() function did not properly validate server certificates containing wildcards. A malicious TLS server could use this flaw to get a specially crafted certificate accepted by a Node.js TLS client.

tags | advisory, web, javascript

systems | linux, redhat

advisories | CVE-2016-1669, CVE-2016-5180, CVE-2016-5325, CVE-2016-7099

SHA-256 | 487f8935425fab345c81e3d7c667d1f0fbea527ff25fc99538a766b46a2d968b

Download | Favorite | View