CVE-2012-2330

Description

The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.

How to fix CVE-2012-2330

To remediate CVE-2012-2330, upgrade the affected package to a fixed version below.

• Debian/nodejs—upgrade to 0.6.17~dfsg1-1 or later

Is CVE-2012-2330 being exploited?

Low — EPSS is 0.6%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.6.17~dfsg1-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2012-2330