CVE-2015-2927: Medium severity langgenius dify node.js vulnerability
node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
Other sources
The following issue was found in node:
The SIGQUIT routine fails to close the app leaving the IP sockets open and in some cases DDOS the remote site if a user "ctrl-]+q" out of a telnet session. Also the app fails to close and more can be spawned by a crafty malicious user thus bringing the system to a point of no memory available.
CVE request:
http://seclists.org/oss-sec/2015/q2/41
Debian tracking bug for this issue:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777013
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2927?
CVE-2015-2927 has a severity rating that indicates it can lead to denial of service due to bandwidth consumption.
How do I fix CVE-2015-2927?
To fix CVE-2015-2927, upgrade to a non-vulnerable version of Node.js or URONode that addresses this issue.
Which versions are affected by CVE-2015-2927?
CVE-2015-2927 affects Node.js version 0.3.2 and URONode versions prior to 1.0.5r3.
What type of attack does CVE-2015-2927 enable?
CVE-2015-2927 allows remote attackers to potentially conduct a denial of service attack through bandwidth consumption.
Is this vulnerability present in Debian distributions?
Yes, CVE-2015-2927 is present in Debian Linux versions 8.0 and 9.0 when using affected packages.