SecuritySpace - CVE-2018-12123

Vulnerability Search		Search 324607 CVE descriptions and 145615 test descriptions, access 10,000+ cross references.
	Tests CVE All

CVE ID: CVE-2018-12123

Description: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.

Test IDs: None available

Cross References: Common Vulnerability Exposure (CVE) ID: CVE-2018-12123
https://security.gentoo.org/glsa/202003-48
RedHat Security Advisories: RHSA-2019:1821
https://access.redhat.com/errata/RHSA-2019:1821

CVE ID:	CVE-2018-12123
Description:	Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2018-12123 https://security.gentoo.org/glsa/202003-48 RedHat Security Advisories: RHSA-2019:1821 https://access.redhat.com/errata/RHSA-2019:1821