CVE-2017-16005

https://notcve.org/view.php?id=CVE-2017-16005

Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature. Http-signature es una "implementación de referencia del esquema de firmas HTTP de Joyent". • https://github.com/joyent/node-http-signature/issues/10 https://nodesecurity.io/advisories/318 • CWE-20: Improper Input Validation CWE-347: Improper Verification of Cryptographic Signature •