Red Hat Bugzilla – Bug 1620219
CVE-2018-12115 nodejs: Out of bounds (OOB) write via UCS-2 encoding
Last modified: 2018-10-18 06:10:52 EDT
Node.js TSC member Сковорода Никита Андреевич (Nikita Skovoroda / @ChALkeR) discovered an OOB write in Buffer that can be used to write to memory outside of a Buffer's memory space. This can corrupt unrelated Buffer objects or cause the Node.js process to crash. When used with UCS-2 encoding (recognized by Node.js under the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'), Buffer#write() can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written. Impact: All previous versions of Node.js 6.x (LTS "Boron") are vulnerable All previous versions of Node.js 8.x (LTS "Carbon") are vulnerable All previous versions of Node.js 10.x (Current) are vulnerable References: https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/
Upstream Fix: https://github.com/nodejs/node/commit/fc14d812b7
This issue has been addressed in the following products: Red Hat OpenShift Application Runtimes Node.js 8 Via RHSA-2018:2552 https://access.redhat.com/errata/RHSA-2018:2552
This issue has been addressed in the following products: Red Hat OpenShift Application Runtimes Node.js 10 Via RHSA-2018:2553 https://access.redhat.com/errata/RHSA-2018:2553
All versions impacted. nodejs advisory doesn't mention 4.x, which also segfaults. Guessing because node 4 is end of lifed.
Created nodejs tracking bugs for this issue: Affects: epel-all [bug 1621655] Affects: fedora-all [bug 1621656]
Statement: Openshift Container Platform 3.x versions are potentially vulnerable via the nodejs-slave-jenkins and nodejs-node-jenkins components. However a build would have to occur with a malicious jenkins pipeline, or nodejs source code supplied by an attacker, reducing the impact of this flaw to moderate.
Mitigation: On Openshift Container Platform 3.x you can override the container image used on the Jenkins Slave by specifying the JENKINS_SLAVE_IMAGE environment variable in your jenkins deployment configuration. Ref: https://github.com/openshift/jenkins/blob/8e1ab16fb5f44d6570018c5dfa3407692fdba6e5/2/contrib/jenkins/kube-slave-common.sh#L27-L33
The logging-kibana component of Openshift Container Platform 3.x does't write to any Buffers, so is not affected by this vulnerability.
The logging-auth-proxy component of Openshift Container Platform 3.x uses NodeJS 0.10 which is not affected by this issue.
.
Fixed upstream in Node.js 6.14.4, 8.11.4, and 10.9.0: https://nodejs.org/en/blog/release/v6.14.4/ https://nodejs.org/en/blog/release/v8.11.4/ https://nodejs.org/en/blog/release/v10.9.0/
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2018:2944 https://access.redhat.com/errata/RHSA-2018:2944
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2018:2949 https://access.redhat.com/errata/RHSA-2018:2949