Bug 1351230 (CVE-2016-1000025)

Summary:	CVE-2016-1000025 nodejs-ws: DoS due to excessively large websocket message
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, ccoleman, dmcphers, jialiu, joelsmith, jokerman, kseifried, lmeyer, mmccomas, tdawson, tiwillia
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-ws 1.1.1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-06-29 18:24:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1351231, 1351232, 1351233
Bug Blocks:	1351235

Description Andrej Nemec 2016-06-29 14:04:31 UTC

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455"

By sending an overly long websocket payload to a ws server, it is possible to crash the node process.

External references:

https://nodesecurity.io/advisories/120

Upstream bug:

https://github.com/nodejs/node/issues/7388

Comment 2 Andrej Nemec 2016-06-29 14:05:15 UTC

Created nodejs-ws tracking bugs for this issue:

Affects: fedora-all [bug 1351231]
Affects: epel-all [bug 1351232]

Comment 3 Kurt Seifried 2016-06-29 18:24:25 UTC

Statement:

This issue affects the versions of nodejs-ws as shipped with Red Hat OpenShift Enterprise 2. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 4 Fedora Update System 2016-07-09 23:52:41 UTC

nodejs-ws-1.1.1-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2016-07-10 05:56:48 UTC

nodejs-ws-1.1.1-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 6 Andrej Nemec 2016-07-13 08:04:16 UTC

CVE assignment:

https://github.com/distributedweaknessfiling/DWF-Database/commit/5e607a0cad2769db2be5aafc4d9b1ec49bd7bbbc

Comment 7 Fedora Update System 2016-07-17 15:46:21 UTC

nodejs-ws-1.1.1-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2016-07-18 18:49:26 UTC

nodejs-ws-1.1.1-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.