CVE-2017-11499 Denial of service in n/a
Remote attackers can cause denial of service in Node.js via hash flooding due to a constant hash table seed caused by V8 snapshots.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-11499?
CVE-2017-11499 is a high-severity denial of service vulnerability in Nodejs Node.js, published on 25 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup.
Weakness: CWE-20
Which versions are affected by CVE-2017-11499?
It affects 1 product.
Linux distribution packages (15)
rh-nodejs4 Red Hat:rhel_software_collections:2::el6 | All versions | 0:2.4-4.el6 |
rh-nodejs4-node-gyp Red Hat:rhel_software_collections:2::el6 | All versions | 0:3.3.1-5.el6 |
rh-nodejs4-nodejs Red Hat:rhel_software_collections:2::el6 | All versions | 1:4.6.2-7.el6 |
rh-nodejs4-nodejs-debuginfo Red Hat:rhel_software_collections:2::el6 | All versions | 1:4.6.2-7.el6 |
rh-nodejs4-nodejs-devel Red Hat:rhel_software_collections:2::el6 | All versions | 1:4.6.2-7.el6 |
rh-nodejs4-nodejs-docs Red Hat:rhel_software_collections:2::el6 | All versions | 1:4.6.2-7.el6 |
rh-nodejs4-runtime Red Hat:rhel_software_collections:2::el6 | All versions | 0:2.4-4.el6 |
rh-nodejs4-scldevel Red Hat:rhel_software_collections:2::el6 | All versions | 0:2.4-4.el6 |
rh-nodejs4 Red Hat:rhel_software_collections:2::el7 | All versions | 0:2.4-3.el7 |
rh-nodejs4-nodejs Red Hat:rhel_software_collections:2::el7 | All versions | 1:4.6.2-6.el7 |
rh-nodejs4-nodejs-debuginfo Red Hat:rhel_software_collections:2::el7 | All versions | 1:4.6.2-6.el7 |
rh-nodejs4-nodejs-devel Red Hat:rhel_software_collections:2::el7 | All versions | 1:4.6.2-6.el7 |
rh-nodejs4-nodejs-docs Red Hat:rhel_software_collections:2::el7 | All versions | 1:4.6.2-6.el7 |
rh-nodejs4-runtime Red Hat:rhel_software_collections:2::el7 | All versions | 0:2.4-3.el7 |
rh-nodejs4-scldevel Red Hat:rhel_software_collections:2::el7 | All versions | 0:2.4-3.el7 |
Products include Nodejs Node.js.
How do I fix CVE-2017-11499?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-11499 being exploited?
There is no known exploitation of CVE-2017-11499 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as DEBIAN-CVE-2017-11499, GHSA-hc9r-2x24-2x3w, RHSA-2017:3002, UBUNTU-CVE-2017-11499.