CVE-2015-9241: Input Validation
Published May 29, 2018
·Updated
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Affected Software
1 affected component
Hapijs Hapi Node.js<11.1.3
Remediation
Event History
May 29, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2015-9241?
CVE-2015-9241 has a medium severity rating due to its potential to cause application disruptions.
2
How do I fix CVE-2015-9241?
To fix CVE-2015-9241, update the hapi node module to version 11.1.3 or later.
3
What software is affected by CVE-2015-9241?
CVE-2015-9241 affects hapi node module versions prior to 11.1.3.
4
What type of issue does CVE-2015-9241 represent?
CVE-2015-9241 represents an illegal access exception due to improper handling of certain HTTP headers.
5
What impact does CVE-2015-9241 have on applications?
CVE-2015-9241 can cause applications to hold open sockets, which may lead to resource exhaustion.