CVE-2018-7159: Input Validation
The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for Content-Length. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.
Other sources
The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values.
References:
https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOGV8.md
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 8.11.0 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 6.14.0 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 4.9.0 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 9.10.0 - Upgrade
Upgrade
redhat/http-parserto a version that resolves this vulnerability.Fixed in 2.8.1 - Configuration
Use a Node.js version where the HTTP parser ignores spaces no longer—i.e., connections are rejected when Content-Length contains spaces such as `Content-Length: 1 2`, interpreted as non-compliant rather than `12`.
Node.js HTTP parser Content-Length parsing (spaces handling) = reject connections / treat Content-Length with spaces as invalid (bring parser into line with HTTP spec) - Operational
After parsing complete in any lower-level HTTP utility code, re-check the length of any input supplied to avoid relying on potentially inaccurate Content-Length values.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7159?
CVE-2018-7159 has been classified as a moderate severity vulnerability.
How do I fix CVE-2018-7159?
To fix CVE-2018-7159, upgrade Node.js to version 4.9.0, 6.14.0, 8.11.0, or 9.10.0.
What versions of Node.js are affected by CVE-2018-7159?
CVE-2018-7159 affects all Node.js versions prior to 4.9.0, 6.14.0, 8.11.0, and 9.10.0.
What does CVE-2018-7159 exploit in Node.js?
CVE-2018-7159 exploits the HTTP parser's handling of spaces in the Content-Length header.
Can CVE-2018-7159 lead to security issues?
Yes, CVE-2018-7159 can potentially lead to security issues by allowing an attacker to manipulate the interpretation of the Content-Length value.