SB2016021017 - Fedora 22 update for nodejs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016021017

SB2016021017 - Fedora 22 update for nodejs

Published: February 10, 2016 Updated: April 24, 2025

Security Bulletin ID SB2016021017
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2016-2216)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.


2) Input validation error (CVE-ID: CVE-2016-2086)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.


Remediation

Install update from vendor's website.

References