CVE-2012-2330: Input Validation
The Update method in src/nodehttpparser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2330?
CVE-2012-2330 is considered a moderate severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2012-2330?
To fix CVE-2012-2330, upgrade Node.js to version 0.6.17 or higher, or to version 0.7.8 or higher.
What types of attacks can be executed using CVE-2012-2330?
CVE-2012-2330 allows remote attackers to obtain sensitive request header contents and potentially spoof HTTP headers.
Which versions of Node.js are affected by CVE-2012-2330?
CVE-2012-2330 affects Node.js versions before 0.6.17 and 0.7 versions before 0.7.8.
Can CVE-2012-2330 lead to data leakage?
Yes, CVE-2012-2330 can lead to data leakage by allowing attackers to access sensitive information from request headers.