CVE-2018-7160

Name	CVE-2018-7160
Description	The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nodejs (PTS)	jessie	0.10.29~dfsg-2	fixed
	stretch	4.8.2~dfsg-1	fixed
	buster (security), buster, buster (lts)	10.24.0~dfsg-1~deb10u4	fixed
	bullseye	12.22.12~dfsg-1~deb11u4	fixed
	bullseye (security)	12.22.12~dfsg-1~deb11u5	fixed
	bookworm	18.19.0+dfsg-6~deb12u2	fixed
	bookworm (security)	18.19.0+dfsg-6~deb12u1	fixed
	trixie	20.18.0+dfsg-2	fixed
	sid	20.18.1+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
nodejs	source	wheezy	(not affected)
nodejs	source	jessie	(not affected)
nodejs	source	stretch	(not affected)
nodejs	source	(unstable)	8.11.1~dfsg-2	unimportant

Notes

[stretch] - nodejs <not-affected> (Vulnerable code not present)
[jessie] - nodejs <not-affected> (Vulnerable code not present)
[wheezy] - nodejs <not-affected> (Vulnerable code not present)