CVE

Id
55573  
CVE No.
CVE-2012-2330  
Status
Candidate  
Description
The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.  
Phase
Assigned (20120419)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
579810 55573 CVE-2012-2330 MLIST:[oss-security] 20120508 CVE request: node.js <0.6.17/0.7.8 HTTP server information disclosure  View
579811 55573 CVE-2012-2330 URL:http://www.openwall.com/lists/oss-security/2012/05/08/4  View
579812 55573 CVE-2012-2330 MLIST:[oss-security] 20120508 Re: CVE request: node.js <0.6.17/0.7.8 HTTP server information disclosure  View
579813 55573 CVE-2012-2330 URL:http://www.openwall.com/lists/oss-security/2012/05/08/8  View
579814 55573 CVE-2012-2330 CONFIRM:http://blog.nodejs.org/2012/05/04/version-0-6-17-stable/  View
579815 55573 CVE-2012-2330 CONFIRM:https://github.com/joyent/node/commit/7b3fb22  View
579816 55573 CVE-2012-2330 CONFIRM:https://github.com/joyent/node/commit/c9a231d  View
579817 55573 CVE-2012-2330 SECUNIA:49066  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
26687 JVNDB-2012-002394 PHP の php-wrapper.fcgi における保護メカニズムを回避される脆弱性 PHP の php-wrapper.fcgi は、コマンドラインの引数を適切に処理しないため、保護メカニズムを回避される、または任意のコードを実行される脆弱性が存在します。 CVE-2012-2335 55573 7.5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002394.html  View