CVE-2018-7162: Denial of Service Vulnerability in TLS
All versions of 9.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation. Thanks to Jordan Zebor at F5 Networks all of his help investigating this issue with the Node.js team.
Other sources
All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.11.2Fixed in 10.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.11.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-7162?
The severity of CVE-2018-7162 is rated as HIGH.
How do I fix CVE-2018-7162?
To fix CVE-2018-7162, upgrade Node.js to version 9.11.2 or later, or version 10.4.1 or later.
What versions of Node.js are affected by CVE-2018-7162?
CVE-2018-7162 affects all versions of Node.js from 9.0.0 to 9.11.2 and 10.0.0 to 10.4.1.
What type of attack does CVE-2018-7162 allow?
CVE-2018-7162 allows an attacker to execute a denial of service (DoS) attack.
What can an attacker send to exploit CVE-2018-7162?
An attacker can exploit CVE-2018-7162 by sending duplicate or unexpected messages during the TLS handshake.