← voltar
CVE-2016-7099

CVE-2016-7099

EPSS 2.8%
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Produtos afetados
n/a · n/a

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0002.htmlhttps://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20bhttps://nodejs.org/en/blog/vulnerability/september-2016-security-releases/http://www.securityfocus.com/bid/93191