Vulnetix
Try Vulnetix Request Demo
CVE-2016-7099 PUBLISHED

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

EPSS 0.72% · 72.3th percentile

Risk Scores

EPSS Score
0.72%
72.3th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTSnodejs0, 0.10.25~dfsg2-2ubuntu1, 4.2.2~dfsg-1
Ubuntu:Pro:14.04:LTSnodejs0, 0.10.25~dfsg2-2ubuntu1.2, 0.10.15~dfsg1-4

Timeline

References

Open in Interactive Console →