DEBIAN-CVE-2016-7099
- Source
- https://security-tracker.debian.org/tracker/CVE-2016-7099
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2016-7099.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2016-7099
- Upstream
- Published
- 2016-10-10T16:59:01Z
- Modified
- 2026-09-01T16:04:12Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
- References
Affected packages
Debian:12 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:deb/debian/nodejs?arch=source&distro=bookworm
Debian:13 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:deb/debian/nodejs?arch=source&distro=trixie
Debian:14 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:deb/debian/nodejs?arch=source&distro=forky