製品・ソフトウェアに関する情報

JVN脆弱性詳細

Node.js における入力確認に関する脆弱性

Title	Node.js における入力確認に関する脆弱性
Summary	Node.js には、入力確認に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 24, 2017, midnight
Registration Date	Nov. 24, 2017, 11:30 a.m.
Last Update	Nov. 24, 2017, 11:30 a.m.

Affected System

Node.js Foundation

Node.js 4.8.5 未満

Node.js 6.11.5 未満の 6.x

Node.js 8.8.0 未満の 8.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-14919	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14919
National Vulnerability Database (NVD)
2	CVE-2017-14919	https://nvd.nist.gov/vuln/detail/CVE-2017-14919

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Node.js Foundation
1	DOS security vulnerability, October 2017	https://nodejs.org/en/blog/vulnerability/oct-2017-dos/
2	Node v4.8.5 (Maintenance)	https://nodejs.org/en/blog/release/v4.8.5/
3	Node v6.11.5 (LTS)	https://nodejs.org/en/blog/release/v6.11.5/
4	Node v8.8.0 (Current)	https://nodejs.org/en/blog/release/v8.8.0/

Change Log

No	Changed Details	Date of change
0	[2017年11月24日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-14919

Summary	Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.
Publication Date	Oct. 31, 2017, 4:29 a.m.
Registration Date	Jan. 26, 2021, 1:16 p.m.
Last Update	Nov. 21, 2024, 12:13 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/101881	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/101881	Third Party Advisory VDB Entry
3	https://nodejs.org/en/blog/release/v4.8.5/	Vendor Advisory
4	https://nodejs.org/en/blog/release/v4.8.5/	Vendor Advisory
5	https://nodejs.org/en/blog/release/v6.11.5/	Vendor Advisory
6	https://nodejs.org/en/blog/release/v6.11.5/	Vendor Advisory
7	https://nodejs.org/en/blog/release/v8.8.0/	Vendor Advisory
8	https://nodejs.org/en/blog/release/v8.8.0/	Vendor Advisory
9	https://nodejs.org/en/blog/vulnerability/oct-2017-dos/	Vendor Advisory
10	https://nodejs.org/en/blog/vulnerability/oct-2017-dos/	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html