Lucene search

K
mageiaGentoo FoundationMGASA-2019-0277
HistorySep 15, 2019 - 4:24 p.m.

Updated nodejs packages fix security vulnerabilities

2019-09-1516:24:16
Gentoo Foundation
advisories.mageia.org
33

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.033 Low

EPSS

Percentile

91.1%

This update provides nodejs v6.17.1 fixing at least the following security issues: The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer (CVE-2017-1000381) Fix for ‘path’ module regular expression denial of service (CVE-2018-7158) Reject spaces in HTTP Content-Length header values (CVE-2018-7159) Fix for inspector DNS rebinding vulnerability (CVE-2018-7160) buffer: Fixes Denial of Service vulnerability where calling Buffer.fill() could hang (CVE-2018-7167) buffer: Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (CVE-2018-12115) Node.js: HTTP request splitting (CVE-2018-12116) Node.js: Debugger port 5858 listens on any interface by default (CVE-2018-12120) Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122) Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737) Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739) For other fixes in this update, see the referenced release logs.

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.033 Low

EPSS

Percentile

91.1%