CVE-2015-7384 HTTP Denial of Service Vulnerability

4,449 views
Skip to first unread message

Rod Vagg

unread,
Sep 30, 2015, 6:40:24 PM9/30/15
to nodejs-sec
## Description and CVSS Score

A bug exists in Node.js versions 4.0.0 to 4.1.1 whereby an external attacker can cause a denial of service. The severity of this issue is high (see CVSS scoring below) and users of the affected versions should plan to upgrade when a fix is made available.

* Versions 0.10 and 0.12 of Node.js are ***not affected***.
* Versions 4.0.0, 4.1.0 and 4.1.1 of Node.js are ***vulnerable***.
* Versions 1 and 2 of io.js are ***not affected*** but remain unsupported and users of these versions are encouraged to migrate to Node.js v4 at their earliest convenience.
* Version 3 of io.js is ***vulnerable*** and while io.js v3 is unsupported, a patch release with a fix will be made available some time next week. Users of io.js v3 are encouraged to migrate to Node.js v4 as a matter of priority.

Full details of this vulnerability are embargoed until a new v4.x release is made available on **Monday the 5th of October 2015**, UTC.

Common Vulnerability Scoring System (CVSS) v3 Base Score:

| Metric                      | Score                      |
|-----------------------------|----------------------------|
| **Base Score:**             | **5.9 (Medium)**           |
| **Base Vector:**            | [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
| **Attack Vector:**          | Network (AV:N)             |
| **Attack Complexity:**      | Medium (AC:H)              |
| **Privileges Required:**    | None (PR:N)                |
| **User Interaction:**       | None (UI:N)                |
| **Scope of Impact:**        | Unchanged (S:U)            |
| **Confidentiality Impact:** | None (C:N)                 |
| **Integrity Impact:**       | None (I:N)                 |
| **Availability Impact:**    | High (A:H)                 |

Complete CVSS v3 Vector: [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C/CR:L/IR:L/AR:M/MAV:N/MAC:H/MPR:N/MUI:N/MS:U/MC:N/MI:N/MA:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C/CR:L/IR:L/AR:M/MAV:N/MAC:H/MPR:N/MUI:N/MS:U/MC:N/MI:N/MA:H). Refer to the [CVSS v3 Specification](https://www.first.org/cvss/specification-document) for details on the meanings and application of the vector components.

CVE-2015-7384 is listed on the [MITRE CVE dictionary](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7384) and [NIST NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7384).

## Action and updates

A new v4.x release on **Monday the 5th of October 2015** will be made available with appropriate fixes for this vulnerability along with disclosure of the details of the bug to allow for complete impact assessment by users.

A new io.js v3.x release will be made on or after Monday the 5th of October 2015 for users having trouble migrating to Node.js v4, however this release does not indicate continued official support of io.js release lines.

## Contact and future updates

Please contact secu...@nodejs.org if you wish to report a vulnerability in Node.js.

Please subscribe to the low-volume announcement-only **nodejs-sec** mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date with security vulnerabilities in Node.js and the projects maintained in the **nodejs** [GitHub organisation](http://github.com/nodejs/).

Rod Vagg

unread,
Oct 5, 2015, 5:28:57 PM10/5/15
to nodejs-sec

Node.js v4.1.2 has been released and is available for download at https://nodejs.org/download/release/v4.1.2/, updates are also being made available via common distribution channels. Please follow up with the maintainers of those channels if you do not have a v4.1.2 available to you shortly.


Please update now if you're using v4.x or io.js v3.x in production.


The bug that has been addressed is primarily concerned with HTTP pipelining. Issue #2639 is an example of the crash that can occur and this is caused by out-of-order responses being sent to the client within a single pipelined connection.


Please note that it is likely that this problem exists even behind a TLS terminator and/or load-balancer.


If you have any further concerns regarding this bug, or have any security-related issues to report please reach out to us at secu...@nodejs.org. General bug reports can be filed at https://github.com/nodejs/node and requests for general help with Node.js can be filed at the new https://github.com/nodejs/help repository.


 -- Rod Vagg (Node.js TSC Member)


Reply all
Reply to author
Forward
0 new messages