ALT-PU-2020-2824

Высокий

ALT-PU-2020-2824: package node update to version 14.11.0-alt1

Источник

errata.altlinux.org

Дата публикации

16.09.2020

Дата обновления

16.09.2020

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades node to version 14.11.0-alt1.

Устраненные уязвимости4

BDU:2020-05657

Высокий 7.4

Дата публикации: 15.12.2020

Уязвимость программной платформы Node.js, связанная с ошибкой обработки имен HTTP - заголовка, позволяющая нарушителю получить доступ к защищаемой информации или повысить свои привилегии

CVSS 3.1

Высокий 7.4

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

CVSS 2.0

Высокий 7.1

AV:N/AC:H/Au:N/C:C/I:C/A:N

Access vector: Network
Complexity: High
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: None

Ссылки

BDU:2020-05657 https://bdu.fstec.ru/vul/2020-05657

Ссылки1

ALT-PU-2020-2824 https://errata.altlinux.org/ALT-PU-2020-2824

Связанные уязвимости

CVE-2020-8251

CVSS3: 7.5

ubuntu

около 6 лет назад

Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.

CVE-2020-8251

CVSS3: 7.5

redhat

около 6 лет назад

Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.

CVE-2020-8251

CVSS3: 7.5

nvd

около 6 лет назад

Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.

CVE-2020-8251

CVSS3: 7.5

debian

около 6 лет назад

Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attack ...

CVE-2020-8201

CVSS3: 7.4

ubuntu

около 6 лет назад

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.