CVE-2018-7167: Buffer Overflow
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.017.1.2.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.1.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.1 - Upgrade
Upgrade
nodejs/6.xto a version that resolves this vulnerability.Fixed in 6.15.0 - Upgrade
Upgrade
nodejs/8.xto a version that resolves this vulnerability.Fixed in 8.14.0 - Upgrade
Upgrade
nodejs/10.xto a version that resolves this vulnerability.Fixed in 10.9.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2018-12115 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2018-12116 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2018-7167
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7167?
CVE-2018-7167 is classified as a Denial of Service vulnerability due to the potential for hanging behavior when using Buffer.fill() or Buffer.alloc().
How do I fix CVE-2018-7167?
To fix CVE-2018-7167, upgrade to the patched versions of Node.js or F5 BIG-IP as specified in the vulnerability reports.
Which software versions are affected by CVE-2018-7167?
CVE-2018-7167 affects multiple versions of Node.js from 6.9.0 to 6.14.3, 8.9.0 to 8.11.3, and 9.0.0 to 9.11.2, as well as specific versions of F5 BIG-IP.
What kind of attack can CVE-2018-7167 facilitate?
CVE-2018-7167 can facilitate a Denial of Service attack by causing the application to hang when certain conditions are met.
Is CVE-2018-7167 a critical vulnerability?
While CVE-2018-7167 is significant, it is primarily a Denial of Service issue which does not allow for remote code execution, making it less critical than other vulnerabilities.