Stories
Slash Boxes
Comments

SoylentNews is people

Node.js Sysadmins: Get Ready to Patch

posted by martyb on Tuesday December 01 2015, @12:35PM   Printer-friendly
from the gonna-need-more-coffee dept.

The Mighty Buzzard sent in some news:

This morning's fun news comes to us courtesy of The Register. In short, there are two vulnerabilities: the most severe one is a remotely-exploitable denial of service (DoS) bug and the other is a medium-severity out-of-bounds access vulnerability. Fixes are due out shortly.

High severity vulnerability: CVE-2015-8027, is a remotely-exploitable denial-of-service (DoS) bug that the node.js Foundation is keeping embargoed until the patch is issued. It affects all versions of v0.12.x through to v5.x, but not versions 0.10.x.

Medium severity vulnerability: CVE-2015-6764, is an out-of-bounds access vulnerability that only affects v4.x and v5.x. An attacker can trigger an out-of-bounds access and/or denial-of-service “if user-supplied JavaScript can be executed by an application”, the CVE says.

There are currently no known exploits in the wild.

See also: InfoWorld and Security Week .

Those of you who have to spend their day updating and testing have my sympathies.

Original Submission

 
This discussion has been archived. No new comments can be posted.
Node.js Sysadmins: Get Ready to Patch | Log In/Create an Account | Top | 23 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 4, Interesting) by darkfeline on Wednesday December 02 2015, @01:42AM

    by darkfeline (1030) on Wednesday December 02 2015, @01:42AM (#270441) Homepage

    I don't think any self-respecting sysadmin would be running Node.js in the first place. If not for technical reasons:

    > '5' - 3
    2        // weak typing + implicit conversions = headaches
    > '5' + 3
    '53'     // Because we all love consistency
    > '5' - '4'
    1        // string - string = integer. What?
    > '5' + + '5'
    '55'
    > 'foo' + + 'foo'
    'fooNaN' // Marvelous.
    > '5' + - '2'
    '5-2'
    > '5' + - + - - + - - + + - + - + - + - - - '-2'
    '52'     // Apparently it's ok

    > var x = 3;
    > '5' + x - x
    50
    > '5' - x + x
    5      // Because fuck math

    Then at least to avoid the bullshit political reasons.

    "But you shouldn't be doing those things in the first place!" If the language has it as a feature, rest assured someone is going to abuse it, and sooner or later you will have to maintain it. Just look at Perl.

    --
    Join the SDF Public Access UNIX System today!
    Starting Score:    1  point
    Moderation   +2  
       Insightful=1, Interesting=1, Total=2
    Extra 'Interesting' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   4