logo

Database

Insecure digital certificates In nodejs

Description

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 19

10

Aliases

1. CVE-2017-158962. NVD-2017-158963. OSV-ALPINE-2017-158964. OSV-2017-158965. GCVE-2017-158966. SECURITY-CVE-2017-15896

References

1. https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.