CVE-2018-12116

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:suse:suse_enterprise_storage:4:*:*:*:*:*:*:*"
            ],
            "vendor_product": "suse:suse_enterprise_storage",
            "extracted_events": [
                {
                    "introduced": "4"
                },
                {
                    "last_affected": "4"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "12"
                },
                {
                    "last_affected": "12"
                },
                {
                    "introduced": "15"
                },
                {
                    "last_affected": "15"
                }
            ],
            "cpes": [
                "cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*",
                "cpe:2.3:o:suse:suse_linux_enterprise_server:15:*:*:*:*:*:*:*"
            ],
            "vendor_product": "suse:suse_linux_enterprise_server",
            "source": "CPE_STRING"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:suse:suse_openstack_cloud:7:*:*:*:*:*:*:*",
                "cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*"
            ],
            "vendor_product": "suse:suse_openstack_cloud",
            "extracted_events": [
                {
                    "introduced": "7"
                },
                {
                    "last_affected": "7"
                },
                {
                    "introduced": "8"
                },
                {
                    "last_affected": "8"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type

GIT

Repo

https://github.com/nodejs/node

Events

Introduced

ce3e3c5fe15479475c068482c48eb9cbf1ac9df5

Last affected

c6a397bce63fc026421e1515b98eec9b8b5a8468

Introduced

6b1c40be84fbe5ea404f25e4e340a0c1fe67a60a

Fixed

b6589e3d9be963b29a8559bf7b272b54284fe1bc

Introduced

0d8021e5a4cf0a6aa3a700a361f6d42c2894f2ba

Last affected

dc6bbb44daec5584a0fbd37f0916baeff3202dba

Introduced

f76ce0a75641991bfc235775a4747c978e0e281b

Fixed

39716a8835a0ba61683974aef70e05ce7f8e414a

Database specific

{
    "cpe": [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"
    ],
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "last_affected": "6.8.1"
        },
        {
            "introduced": "6.9.0"
        },
        {
            "fixed": "6.15.0"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.8.1"
        },
        {
            "introduced": "8.9.0"
        },
        {
            "fixed": "8.14.0"
        }
    ]
}

Affected versions

v6.*

v6.0.0

v6.1.0

v6.10.0

v6.10.1

v6.10.2

v6.10.3

v6.11.0

v6.11.1

v6.11.2

v6.11.3

v6.11.4

v6.11.5

v6.12.0

v6.12.1

v6.12.2

v6.12.3

v6.13.0

v6.13.1

v6.14.0

v6.14.1

v6.14.2

v6.14.3

v6.14.4

v6.2.0

v6.2.1

v6.2.2

v6.3.0

v6.3.1

v6.4.0

v6.5.0

v6.6.0

v6.7.0

v6.8.0

v6.8.1

v6.9.0

v6.9.1

v6.9.2

v6.9.3

v6.9.4

v6.9.5

v8.*

v8.0.0

v8.1.0

v8.1.1

v8.1.2

v8.1.3

v8.1.4

v8.10.0

v8.11.0

v8.11.1

v8.11.2

v8.11.3

v8.11.4

v8.12.0

v8.13.0

v8.2.0

v8.2.1

v8.3.0

v8.4.0

v8.5.0

v8.6.0

v8.7.0

v8.8.0

v8.8.1

v8.9.0

v8.9.1

v8.9.2

v8.9.3

v8.9.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12116.json"