nodejs: two vulnerabilities
| Package(s): | nodejs | CVE #(s): | CVE-2016-2216 CVE-2016-2086 | ||||||||||||||||||||
| Created: | February 15, 2016 | Updated: | February 29, 2016 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-2216: It was reported that HTTP header parsing in Node.js is vulnerable to response splitting attacks. While Node.js has been protecting against response splitting attacks by checking for CRLF characters, it is possible to compose response headers using Unicode characters that decompose to these characters, bypassing the checks previously in place. CVE-2016-2086: A request smuggling vulnerability was found in Node.js that can be exploited under certain unspecified circumstances. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||