Описание
Security update for nodejs8
This update for nodejs8 to version 8.15.0 fixes the following issues:
Security issues fixed:
- CVE-2018-12121: Fixed a Denial of Service with large HTTP headers (bsc#1117626)
- CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of Service (bsc#1117627)
- CVE-2018-12116: Fixed HTTP request splitting (bsc#1117630)
- CVE-2018-12123: Fixed hostname spoofing in URL parser for javascript protocol (bsc#1117629)
Список пакетов
SUSE Linux Enterprise Module for Web and Scripting 15
Ссылки
- Link for SUSE-SU-2019:0118-1
- E-Mail link for SUSE-SU-2019:0118-1
- SUSE Security Ratings
- SUSE Bug 1117626
- SUSE Bug 1117627
- SUSE Bug 1117629
- SUSE Bug 1117630
- SUSE CVE CVE-2018-12116 page
- SUSE CVE CVE-2018-12121 page
- SUSE CVE CVE-2018-12122 page
- SUSE CVE CVE-2018-12123 page
Описание
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
Затронутые продукты
Ссылки
- CVE-2018-12116
- SUSE Bug 1117630
Описание
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
Затронутые продукты
Ссылки
- CVE-2018-12121
- SUSE Bug 1117626
- SUSE Bug 1127532
Описание
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.
Затронутые продукты
Ссылки
- CVE-2018-12122
- SUSE Bug 1117627
Описание
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
Затронутые продукты
Ссылки
- CVE-2018-12123
- SUSE Bug 1117629