(RHSA-2015:1545) Important: node.js security update

2015-08-0400:00:00

access.redhat.com

3.4 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.975 High

EPSS

Percentile

100.0%

JSON

OpenShift Enterprise by Red Hat is the company’s cloud computing
Platform-as-a-Service (PaaS) solution designed for on-premise or private
cloud deployments.

Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.

A flaw was found in the way SSL 3.0 handled padding bytes when decrypting
messages encrypted using block ciphers in cipher block chaining (CBC) mode.
This flaw allows a man-in-the-middle (MITM) attacker to decrypt a selected
byte of a cipher text in as few as 256 tries if they are able to force a
victim application to repeatedly send the same data over newly created SSL
3.0 connections. (CVE-2014-3566)

All OpenShift Enterprise users are advised to upgrade to these updated
packages, which correct this issue.

OSVersionArchitecturePackageVersionFilename
RedHat6noarchopenshift-origin-node-proxy< 1.22.3.4-1.el6opopenshift-origin-node-proxy-1.22.3.4-1.el6op.noarch.rpm
RedHat6srcopenshift-origin-node-proxy< 1.22.3.4-1.el6opopenshift-origin-node-proxy-1.22.3.4-1.el6op.src.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	6	noarch	openshift-origin-node-proxy	< 1.22.3.4-1.el6op	openshift-origin-node-proxy-1.22.3.4-1.el6op.noarch.rpm
RedHat	6	src	openshift-origin-node-proxy	< 1.22.3.4-1.el6op	openshift-origin-node-proxy-1.22.3.4-1.el6op.src.rpm