CVE-2018-7162
Severity
7.5HIGH
EPSS
1.0%
top 22.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 13
Latest updateMay 13
Description
All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages3 packages
🔴Vulnerability Details
3📋Vendor Advisories
3Red Hat▶
nodejs: denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash↗2018-06-12
Microsoft▶
All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS ser↗2018-06-12
Debian▶
CVE-2018-7162: nodejs - All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An...↗2018
💬Community
3Bugzilla▶
CVE-2018-7162 nodejs: denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash [epel-all]↗2018-06-13
Bugzilla▶
CVE-2018-7162 nodejs: denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash [fedora-all]↗2018-06-13
Bugzilla▶
CVE-2018-7162 nodejs: denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash↗2018-06-13