FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

node -- access to unintended files

Affected packages
8.5.0 <= node < 8.6.0

Details

VuXML ID 1257718e-be97-458a-9744-d938b592db42
Discovery 2017-09-27
Entry 2017-10-10

node developers report:

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.

[source]

References

CVE Name CVE-2017-14849
URL http://www.securityfocus.com/bid/101056

Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright information.

OSZAR »