Candidate: CVE-2016-7099
PublicDate: 2016-10-10 16:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7099
 https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
Description:
 The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47,
 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not
 properly handle wildcards in name fields of X.509 certificates, which
 allows man-in-the-middle attackers to spoof servers via a crafted
 certificate.
Ubuntu-Description:
 Alexander Minozhenko and James Bunton discovered that Node.js did not properly
 handle wildcards in name fields of X.509 TLS certificates. An attacker could
 use this vulnerability to execute a man-in-the-middle-attack.
Notes:
Bugs:
Priority: medium
Discovered-by: Alexander Minozhenko and James Bunton
Assigned-to: mikesalvatore
CVSS:
 nvd: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N [5.9 MEDIUM]

Patches_nodejs:
 upstream: https://github.com/nodejs/node/commit/0d7e21ee7bcc79046f898f8c202d2ec87d23d711 (0.10)
 upstream: https://github.com/nodejs/node/commit/3ff82deb2c3bd580d64be75dbafe460393c952fb (4.x)
upstream_nodejs: released (4.6.0~dfsg-1)
precise_nodejs: ignored (reached end-of-life)
precise/esm_nodejs: DNE (precise was needs-triage)
trusty_nodejs: ignored (out of standard support)
trusty/esm_nodejs: needed

vivid/stable-phone-overlay_nodejs: DNE
vivid/ubuntu-core_nodejs: DNE
xenial_nodejs: ignored (end of standard support, was needed)

yakkety_nodejs: ignored (reached end-of-life)
zesty_nodejs: ignored (reached end-of-life)
artful_nodejs: ignored (reached end-of-life)
bionic_nodejs: not-affected (8.10.0~dfsg-2)
cosmic_nodejs: not-affected (8.11.2~dfsg-1)
disco_nodejs: not-affected (8.11.2~dfsg-1)
eoan_nodejs: not-affected (8.11.2~dfsg-1)
focal_nodejs: not-affected (8.11.2~dfsg-1)
groovy_nodejs: not-affected (8.11.2~dfsg-1)
hirsute_nodejs: not-affected (8.11.2~dfsg-1)
impish_nodejs: not-affected (8.11.2~dfsg-1)
jammy_nodejs: not-affected (8.11.2~dfsg-1)
devel_nodejs: not-affected (8.11.2~dfsg-1)