The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.

This update fixes the following security issue with nodejs :

  - fix CVE-2013-4450: nodejs: HTTP Pipelining DoS     (bnc#846808) CVE-2013-4450-v0.10.x.patch: contains the     fix

This release contains a security fix for the http server implementation, please upgrade as soon as possible. For more information, see <http://ur1.ca/fwrj8>.

2013.10.18, node.js Version 0.10.21 (Stable)

  - crypto: clear errors from verify failure (Timothy J     Fontaine)

  - dtrace: interpret two byte strings (Dave Pacheco)

  - fs: fix fs.truncate() file content zeroing bug (Ben     Noordhuis)

  - http: provide backpressure for pipeline flood (isaacs)

  - tls: fix premature connection termination (Ben     Noordhuis)

2013.10.19, libuv Version 0.10.18 (Stable)

  - unix: fix uv_spawn() NULL pointer deref on ENOMEM (Ben     Noordhuis)

  - unix: don't close inherited fds on uv_spawn() fail (Ben     Noordhuis)

  - unix: revert recent FSEvent changes (Ben Noordhuis)

  - unix: fix non-synchronized access in signal.c (Ben     Noordhuis)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75229	openSUSE Security Update : nodejs (openSUSE-SU-2013:1863-1)	Nessus	SuSE Local Security Checks	medium
70820	Fedora 20 : libuv-0.10.18-1.fc20 / nodejs-0.10.21-1.fc20 (2013-19512)	Nessus	Fedora Local Security Checks	medium
70670	Fedora 19 : libuv-0.10.18-1.fc19 / nodejs-0.10.21-1.fc19 (2013-19497)	Nessus	Fedora Local Security Checks	medium
70669	Fedora 18 : libuv-0.10.18-1.fc18 / nodejs-0.10.21-1.fc18 (2013-19491)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4450

critical

Tenable Plugins

medium

medium

medium

medium