Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2017-15896

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could s

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
nodejs

Description

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

The Node.js Project Node.js

  • 4.0.0 and higheraffected
  • 6.0.0 and higheraffected
  • 8.0.0 and higheraffected
  • 9.0.0 and higheraffected

References