CVE-2018-7167: Calls to Buffer.fill() and/or Buffer.alloc() may hang
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.017.1.2.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.1.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.14.3Fixed in 8.11.3Fixed in 9.11.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.14.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.11.2 - Upgrade
Upgrade
ubuntu/nodejsto a version that resolves this vulnerability.Fixed in 8.10.0~dfsg-2ubuntu0.4+esm1 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 6.14.4 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 8.11.4 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 10.9.0 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 6.15.0 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 8.14.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-7167?
CVE-2018-7167 is classified as a Denial of Service vulnerability due to the potential for hanging behavior when using Buffer.fill() or Buffer.alloc().
How do I fix CVE-2018-7167?
To fix CVE-2018-7167, upgrade to the patched versions of Node.js or F5 BIG-IP as specified in the vulnerability reports.
Which software versions are affected by CVE-2018-7167?
CVE-2018-7167 affects multiple versions of Node.js from 6.9.0 to 6.14.3, 8.9.0 to 8.11.3, and 9.0.0 to 9.11.2, as well as specific versions of F5 BIG-IP.
What kind of attack can CVE-2018-7167 facilitate?
CVE-2018-7167 can facilitate a Denial of Service attack by causing the application to hang when certain conditions are met.
Is CVE-2018-7167 a critical vulnerability?
While CVE-2018-7167 is significant, it is primarily a Denial of Service issue which does not allow for remote code execution, making it less critical than other vulnerabilities.