Bug 1588846 (CVE-2017-16005)

Summary: CVE-2017-16005 nodejs-http-signature: HTTP header forgery
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ahardin, bleanhar, ccoleman, dedgar, dffrench, drusso, hhorak, jgoulding, jmadigan, jokerman, jorton, jshepherd, lgriffin, mchappel, ngough, nodejs-sig, piotr1212, pwright, rrajasek, tchollingsworth, trepel, zsvetlik
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:28:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1588847, 1588848, 1588849    
Bug Blocks: 1588850    

Description Pedro Sampaio 2018-06-07 23:53:03 UTC 
Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.

Upstream issue:

https://github.com/joyent/node-http-signature/issues/10

External references:

https://nodesecurity.io/advisories/318
Comment 1 Pedro Sampaio 2018-06-07 23:53:34 UTC 
Created nodejs-http-signature tracking bugs for this issue:

Affects: epel-all [bug 1588847]
Affects: fedora-all [bug 1588848]
Comment 3 Pedro Yóssis Silva Barbosa 2018-06-13 21:14:24 UTC 
The current versions (0.10.0 for nodejs4 and 1.1.1 for nodejs6) of http-signature shipped in Red Hat Software Collections are not affected.
Comment 4 Jason Shepherd 2018-06-27 06:11:25 UTC 
The current versions of http-signature used in RHMAP 4.6 are not affected.
Comment 5 Jason Shepherd 2018-06-27 06:12:51 UTC 
The current version of http-signature (0.11.0-1.el7aos) used in OCP 3.x are not affected.