CVE-2016-7099

medium

Description

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

References

Advisories
More

http://www.securityfocus.com/bid/93191

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20b

http://rhn.redhat.com/errata/RHSA-2017-0002.html

Details

Source: Mitre, NVD

Published: 2016-10-10

Updated: 2025-04-12

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Severity: Medium

EPSS

EPSS: 0.00144