bugtraq - Safebreach adsivory: Node.js HTTP Response Splitting (CVE-2016-2216)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CANEQ_+KVfbcDcrHCixGGCb7ak8=ON4utTq9WNoG2B0ePRKyNww@mail.gmail.com>
Date: Tue, 9 Feb 2016 20:27:31 +0200
From: Amit Klein <aksecurity@...il.com>
To: bugtraq@...urityfocus.com
Subject: Safebreach adsivory: Node.js HTTP Response Splitting (CVE-2016-2216)

Dear list

Safebreach just published an advisory on HTTP Response Splitting
vulnerability in Node.js:
http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf

The advisory is accompanied by a blog post:
http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/

Node.js has fixed versions ready to download, see:
https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/

Thanks,
-Amit