CVE-2018-7161

All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nodejsCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
VendorProductVersion
nodejsnode.js
8.0.0 ≤
𝑥
≤ 8.8.1
nodejsnode.js
8.9.0 ≤
𝑥
< 8.11.3
nodejsnode.js
9.0.0 ≤
𝑥
< 9.11.2
nodejsnode.js
10.0.0 ≤
𝑥
< 10.4.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nodejs
bullseye
12.22.12~dfsg-1~deb11u4
fixed
stretch
not-affected
jessie
not-affected
bullseye (security)
12.22.12~dfsg-1~deb11u5
fixed
bookworm
18.19.0+dfsg-6~deb12u2
fixed
bookworm (security)
18.19.0+dfsg-6~deb12u1
fixed
sid
20.17.0+dfsg-2
fixed
trixie
20.17.0+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nodejs
cosmic
not-affected
bionic
Fixed 8.10.0~dfsg-2ubuntu0.2
released
artful
ignored
xenial
not-affected
trusty
not-affected
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/106363
https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/
https://security.gentoo.org/glsa/202003-48
http://www.securityfocus.com/bid/106363
https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/
https://security.gentoo.org/glsa/202003-48