Bug 1295717

Summary:	nodejs-ws: Remote memory disclosure via ping functionality
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abhgupta, ccoleman, dmcphers, jialiu, joelsmith, jokerman, kseifried, lmeyer, mmccomas, tdawson, tiwillia
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-ws 1.0.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-01-19 20:56:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	1295718, 1295719, 1295720, 1295721
Bug Blocks:	1295723

Description Adam Mariš 2016-01-05 10:53:56 UTC

A vulnerability in the ping functionality of ws module which allowed clients to allocate memory by simply sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. As a result, client receives non-zeroed out allocated buffer from server of arbitrary length. Assuming the usage of modern kernel, only the memory previously used and deallocated by the node process and the memory that has been previously allocated as a Buffer can be leaked using this way.

External reference:

https://nodesecurity.io/advisories/67

Comment 3 Adam Mariš 2016-01-05 10:55:00 UTC

Created nodejs-ws tracking bugs for this issue:

Affects: fedora-all [bug 1295718]
Affects: epel-all [bug 1295719]

Comment 4 Kurt Seifried 2016-01-12 04:56:15 UTC

OpenShift Enterprise 2.x does not use the ping functionality in openshift-origin-node-proxy.

Comment 5 Fedora Update System 2016-01-14 08:53:34 UTC

nodejs-ws-1.0.1-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2016-01-14 09:49:14 UTC

nodejs-ws-1.0.1-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2016-01-21 04:27:15 UTC

nodejs-ws-1.0.1-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2016-01-21 04:37:21 UTC

nodejs-ws-1.0.1-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.