The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2949 advisory.

  - nodejs: HTTP parser allowed for spaces inside Content-Length header values (CVE-2018-7159)

  - nodejs: Inspector DNS rebinding vulnerability (CVE-2018-7160)

  - nodejs: denial of service (DoS) by causing a node server providing an http2 server to crash     (CVE-2018-7161)

  - nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters     (CVE-2018-7167)

  - nodejs: Out of bounds (OOB) write via UCS-2 encoding (CVE-2018-12115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2258 advisory.

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large     HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per     connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to     abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other     proxy layer. (CVE-2018-12121)

  - The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing     input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification     does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into     line on this particular difference. The security risk of this flaw to Node.js users is considered to be     VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a     way that could not already be achieved by supplying an incorrect value for `Content-Length`.
    Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of     this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP     utilities are advised to re-check the length of any input supplied after parsing is complete.
    (CVE-2018-7159)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for http-parser is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The http-parser package provides a utility for parsing HTTP messages.
It parses both requests and responses. The parser is designed to be used in performance HTTP applications. It does not make any system calls or allocations, it does not buffer data, and it can be interrupted at any time. Depending on your architecture, it only requires about 40 bytes of data per message stream.

Security Fix(es) :

* nodejs: Denial of Service with large HTTP headers (CVE-2018-12121)

* nodejs: HTTP parser allowed for spaces inside Content-Length header values (CVE-2018-7159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the http-parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0,     10.14.0 and 11.3.0: Denial of Service with large HTTP     headers: By using a combination of many requests with     maximum sized headers (almost 80 KB per connection),     and carefully timed completion of the headers, it is     possible to cause the HTTP server to abort from heap     allocation failure. Attack potential is mitigated by     the use of a load balancer or other proxy     layer.(CVE-2018-12121)

  - The HTTP parser in all current versions of Node.js     ignores spaces in the `Content-Length` header, allowing     input such as `Content-Length: 1 2` to be interpreted     as having a value of `12`. The HTTP specification does     not allow for spaces in the `Content-Length` value and     the Node.js HTTP parser has been brought into line on     this particular difference. The security risk of this     flaw to Node.js users is considered to be VERY LOW as     it is difficult, and may be impossible, to craft an     attack that makes use of this flaw in a way that could     not already be achieved by supplying an incorrect value     for `Content-Length`. Vulnerabilities may exist in     user-code that make incorrect assumptions about the     potential accuracy of this value compared to the actual     length of the data supplied. Node.js users crafting     lower-level HTTP utilities are advised to re-check the     length of any input supplied after parsing is     complete.(CVE-2018-7159)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the Node.js code where a specially crafted HTTP(s) request sent to a Node.js server failed to properly process the HTTP(s) headers, resulting in a request smuggling attack. An attacker can use this flaw to alter a request sent as an authenticated user if the Node.js server is deployed behind a proxy server that reuses connections. (CVE-2019-15605)

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer. (CVE-2018-12121)

It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior. (CVE-2018-7159)

According to the versions of the http-parser package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0,     10.14.0 and 11.3.0: Denial of Service with large HTTP     headers: By using a combination of many requests with     maximum sized headers (almost 80 KB per connection),     and carefully timed completion of the headers, it is     possible to cause the HTTP server to abort from heap     allocation failure. Attack potential is mitigated by     the use of a load balancer or other proxy     layer.(CVE-2018-12121)

  - The HTTP parser in all current versions of Node.js     ignores spaces in the `Content-Length` header, allowing     input such as `Content-Length: 1 2` to be interpreted     as having a value of `12`. The HTTP specification does     not allow for spaces in the `Content-Length` value and     the Node.js HTTP parser has been brought into line on     this particular difference. The security risk of this     flaw to Node.js users is considered to be VERY LOW as     it is difficult, and may be impossible, to craft an     attack that makes use of this flaw in a way that could     not already be achieved by supplying an incorrect value     for `Content-Length`. Vulnerabilities may exist in     user-code that make incorrect assumptions about the     potential accuracy of this value compared to the actual     length of the data supplied. Node.js users crafting     lower-level HTTP utilities are advised to re-check the     length of any input supplied after parsing is     complete.(CVE-2018-7159)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the http-parser package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0,     10.14.0 and 11.3.0: Denial of Service with large HTTP     headers: By using a combination of many requests with     maximum sized headers (almost 80 KB per connection),     and carefully timed completion of the headers, it is     possible to cause the HTTP server to abort from heap     allocation failure. Attack potential is mitigated by     the use of a load balancer or other proxy     layer.(CVE-2018-12121)

  - The HTTP parser in all current versions of Node.js     ignores spaces in the `Content-Length` header, allowing     input such as `Content-Length: 1 2` to be interpreted     as having a value of `12`. The HTTP specification does     not allow for spaces in the `Content-Length` value and     the Node.js HTTP parser has been brought into line on     this particular difference. The security risk of this     flaw to Node.js users is considered to be VERY LOW as     it is difficult, and may be impossible, to craft an     attack that makes use of this flaw in a way that could     not already be achieved by supplying an incorrect value     for `Content-Length`. Vulnerabilities may exist in     user-code that make incorrect assumptions about the     potential accuracy of this value compared to the actual     length of the data supplied. Node.js users crafting     lower-level HTTP utilities are advised to re-check the     length of any input supplied after parsing is     complete.(CVE-2018-7159)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has http-parser packages installed that are affected by multiple vulnerabilities:

  - The HTTP parser in all current versions of Node.js     ignores spaces in the `Content-Length` header, allowing     input such as `Content-Length: 1 2` to be interpreted as     having a value of `12`. The HTTP specification does not     allow for spaces in the `Content-Length` value and the     Node.js HTTP parser has been brought into line on this     particular difference. The security risk of this flaw to     Node.js users is considered to be VERY LOW as it is     difficult, and may be impossible, to craft an attack     that makes use of this flaw in a way that could not     already be achieved by supplying an incorrect value for     `Content-Length`. Vulnerabilities may exist in user-code     that make incorrect assumptions about the potential     accuracy of this value compared to the actual length of     the data supplied. Node.js users crafting lower-level     HTTP utilities are advised to re-check the length of any     input supplied after parsing is complete.
    (CVE-2018-7159)

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0,     10.14.0 and 11.3.0: Denial of Service with large HTTP     headers: By using a combination of many requests with     maximum sized headers (almost 80 KB per connection), and     carefully timed completion of the headers, it is     possible to cause the HTTP server to abort from heap     allocation failure. Attack potential is mitigated by the     use of a load balancer or other proxy layer.
    (CVE-2018-12121)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the http-parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - This is a parser for HTTP messages written in C. It     parses both requests and responses. The parser is     designed to be used in performance HTTP applications.It     does not make any syscalls nor allocations, it does not     buffer data, it can be interrupted at anytime.
    Depending on your architecture, it only requires about     40 bytes of data per message stream (in a web server     that is per connection).Security Fix(es):The HTTP     parser in all current versions of Node.js ignores     spaces in the `Content-Length` header, allowing input     such as `Content-Length: 1 2` to be interpreted as     having a value of `12`. The HTTP specification does not     allow for spaces in the `Content-Length` value and the     Node.js HTTP parser has been brought into line on this     particular difference. The security risk of this flaw     to Node.js users is considered to be VERY LOW as it is     difficult, and may be impossible, to craft an attack     that makes use of this flaw in a way that could not     already be achieved by supplying an incorrect value for     `Content-Length`. Vulnerabilities may exist in     user-code that make incorrect assumptions about the     potential accuracy of this value compared to the actual     length of the data supplied. Node.js users crafting     lower-level HTTP utilities are advised to re-check the     length of any input supplied after parsing is     complete.(CVE-2018-7159)Node.js: All versions prior to     Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of     Service with large HTTP headers: By using a combination     of many requests with maximum sized headers (almost 80     KB per connection), and carefully timed completion of     the headers, it is possible to cause the HTTP server to     abort from heap allocation failure. Attack potential is     mitigated by the use of a load balancer or other proxy     layer.(CVE-2018-12121)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the http-parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The HTTP parser in all current versions of Node.js     ignores spaces in the `Content-Length` header, allowing     input such as `Content-Length: 1 2` to be interpreted     as having a value of `12`. The HTTP specification does     not allow for spaces in the `Content-Length` value and     the Node.js HTTP parser has been brought into line on     this particular difference. The security risk of this     flaw to Node.js users is considered to be VERY LOW as     it is difficult, and may be impossible, to craft an     attack that makes use of this flaw in a way that could     not already be achieved by supplying an incorrect value     for `Content-Length`. Vulnerabilities may exist in     user-code that make incorrect assumptions about the     potential accuracy of this value compared to the actual     length of the data supplied. Node.js users crafting     lower-level HTTP utilities are advised to re-check the     length of any input supplied after parsing is     complete.(CVE-2018-7159)

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0,     10.14.0 and 11.3.0: Denial of Service with large HTTP     headers: By using a combination of many requests with     maximum sized headers (almost 80 KB per connection),     and carefully timed completion of the headers, it is     possible to cause the HTTP server to abort from heap     allocation failure. Attack potential is mitigated by     the use of a load balancer or other proxy     layer.(CVE-2018-12121)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.(CVE-2018-12121)

It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior.(CVE-2018-7159)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has http-parser packages installed that are affected by multiple vulnerabilities:

  - The HTTP parser in all current versions of Node.js     ignores spaces in the `Content-Length` header, allowing     input such as `Content-Length: 1 2` to be interpreted as     having a value of `12`. The HTTP specification does not     allow for spaces in the `Content-Length` value and the     Node.js HTTP parser has been brought into line on this     particular difference. The security risk of this flaw to     Node.js users is considered to be VERY LOW as it is     difficult, and may be impossible, to craft an attack     that makes use of this flaw in a way that could not     already be achieved by supplying an incorrect value for     `Content-Length`. Vulnerabilities may exist in user-code     that make incorrect assumptions about the potential     accuracy of this value compared to the actual length of     the data supplied. Node.js users crafting lower-level     HTTP utilities are advised to re-check the length of any     input supplied after parsing is complete.
    (CVE-2018-7159)

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0,     10.14.0 and 11.3.0: Denial of Service with large HTTP     headers: By using a combination of many requests with     maximum sized headers (almost 80 KB per connection), and     carefully timed completion of the headers, it is     possible to cause the HTTP server to abort from heap     allocation failure. Attack potential is mitigated by the     use of a load balancer or other proxy layer.
    (CVE-2018-12121)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete. (CVE-2018-7159)

Impact

BIG-IP

According to CVE-2018-7159, it may be impossible to craft an attack that uses this flaw in a way that could not already be achieved by supplying an incorrect 'Content-Length' value. However, when the flaw is exploited, it may cause the affected Node.js component to behave unexpectedly.

BIG-IQ, F5 iWorkflow, Enterprise Manager, and Traffix SDC

There is no impact; these F5 products are not affected by this vulnerability.

An update for http-parser is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The http-parser package provides a utility for parsing HTTP messages.
It parses both requests and responses. The parser is designed to be used in performance HTTP applications. It does not make any system calls or allocations, it does not buffer data, and it can be interrupted at any time. Depending on your architecture, it only requires about 40 bytes of data per message stream.

Security Fix(es) :

* nodejs: Denial of Service with large HTTP headers (CVE-2018-12121)

* nodejs: HTTP parser allowed for spaces inside Content-Length header values (CVE-2018-7159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - nodejs: Denial of Service with large HTTP headers     (CVE-2018-12121)

  - nodejs: HTTP parser allowed for spaces inside     Content-Length header values (CVE-2018-7159)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2258 advisory.

  - nodejs: HTTP parser allowed for spaces inside Content-Length header values (CVE-2018-7159)

  - nodejs: Denial of Service with large HTTP headers (CVE-2018-12121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs6 fixes the following issues :

  - Fix some node-gyp permissions

  - New upstream LTS release 6.14.1 :

  - Security fixes :

  + CVE-2018-7160: Fix for inspector DNS rebinding     vulnerability (bsc#1087463)

  + CVE-2018-7158: Fix for 'path' module regular expression     denial of service (bsc#1087459)

  + CVE-2018-7159: Reject spaces in HTTP Content-Length     header values (bsc#1087453)

  - New upstream LTS release 6.13.1 :

  - http,tls: better support for IPv6 addresses

  - console: added console.count() and console.clear()

  - crypto :

  + expose ECDH class

  + added cypto.randomFill() and crypto.randomFillSync()

  + warn on invalid authentication tag length

  - deps: upgrade libuv to 1.16.1

  - dgram: added socket.setMulticastInterface()

  - http: add agent.keepSocketAlive and agent.reuseSocket as to allow overridable keep-alive behavior of Agent

  - lib: return this from net.Socket.end()

  - module: add builtinModules api that provides list of all     builtin modules in Node

  - net: return this from getConnections()

  - promises: more robust stringification for unhandled     rejections

  - repl: improve require() autocompletion

  - src :

  + add openssl-system-ca-path configure option

  + add --use-bundled-ca --use-openssl-ca check

  + add process.ppid

  - tls: accept lookup option for tls.connect()

  - tools,build: a new macOS installer!

  - url: WHATWG URL api support

  - util: add %i and %f formatting specifiers

  - remove any old manpage files in %pre from before     update-alternatives were used to manage symlinks to     these manpages.

  - Add Recommends and BuildRequire on python2 for npm.
    node-gyp requires this old version of python for now.
    This is only needed for binary modules.

  - even on recent codestreams there is no binutils gold on     s390 only on s390x

  - New upstream LTS release 6.12.3 :

  - v8: profiler-related fixes

  - mostly documentation and test related changes

  - Enable CI tests in %check target

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 fixes the following issues :

  - Fix some node-gyp permissions

  - New upstream maintenance 4.9.1 :

  - Security fixes :

  + CVE-2018-7158: Fix for 'path' module regular expression     denial of service (bsc#1087459)

  + CVE-2018-7159: Reject spaces in HTTP Content-Length     header values (bsc#1087453)

  - Upgrade to OpenSSL 1.0.2o

  - deps: reject interior blanks in Content-Length

  - deps: upgrade http-parser to v2.8.0

  - remove any old manpage files in %pre from before     update-alternatives were used to manage symlinks to     these manpages.

  - Add Recommends and BuildRequire on python2 for npm.
    node-gyp requires this old version of python for now.
    This is only needed for binary modules.

  - even on recent codestreams there is no binutils gold on     s390 only on s390x

  - Enable CI tests in %check target

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Node.js installed on the remote host is 4.x prior to 4.9.0, 6.x prior to 6.14.0, 8.x prior to 8.11.0 or 9.x prior to 9.10.0. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs6 fixes the following issues :

  - Fix some node-gyp permissions

  - New upstream LTS release 6.14.1 :

  - Security fixes :

  + CVE-2018-7160: Fix for inspector DNS rebinding     vulnerability (bsc#1087463)

  + CVE-2018-7158: Fix for 'path' module regular expression     denial of service (bsc#1087459)

  + CVE-2018-7159: Reject spaces in HTTP Content-Length     header values (bsc#1087453)

  - New upstream LTS release 6.13.1 :

  - http,tls: better support for IPv6 addresses

  - console: added console.count() and console.clear()

  - crypto :

  + expose ECDH class

  + added cypto.randomFill() and crypto.randomFillSync()

  + warn on invalid authentication tag length

  - deps: upgrade libuv to 1.16.1

  - dgram: added socket.setMulticastInterface()

  - http: add agent.keepSocketAlive and agent.reuseSocket as to allow overridable keep-alive behavior of Agent

  - lib: return this from net.Socket.end()

  - module: add builtinModules api that provides list of all     builtin modules in Node

  - net: return this from getConnections()

  - promises: more robust stringification for unhandled     rejections

  - repl: improve require() autocompletion

  - src :

  + add openssl-system-ca-path configure option

  + add --use-bundled-ca --use-openssl-ca check

  + add process.ppid

  - tls: accept lookup option for tls.connect()

  - tools,build: a new macOS installer!

  - url: WHATWG URL api support

  - util: add %i and %f formatting specifiers

  - remove any old manpage files in %pre from before     update-alternatives were used to manage symlinks to     these manpages.

  - Add Recommends and BuildRequire on python2 for npm.
    node-gyp requires this old version of python for now.
    This is only needed for binary modules.

  - even on recent codestreams there is no binutils gold on     s390 only on s390x

  - New upstream LTS release 6.12.3 :

  - v8: profiler-related fixes

  - mostly documentation and test related changes

  - Enable CI tests in %check target

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs4 fixes the following issues :

  - Fix some node-gyp permissions

  - New upstream maintenance 4.9.1 :

  - Security fixes :

  + CVE-2018-7158: Fix for 'path' module regular expression     denial of service (bsc#1087459)

  + CVE-2018-7159: Reject spaces in HTTP Content-Length     header values (bsc#1087453)

  - Upgrade to OpenSSL 1.0.2o

  - deps: reject interior blanks in Content-Length

  - deps: upgrade http-parser to v2.8.0

  - remove any old manpage files in %pre from before     update-alternatives were used to manage symlinks to     these manpages.

  - Add Recommends and BuildRequire on python2 for npm.
    node-gyp requires this old version of python for now.
    This is only needed for binary modules.

  - even on recent codestreams there is no binutils gold on     s390 only on s390x

  - Enable CI tests in %check target This update was     imported from the SUSE:SLE-12:Update update project.

Node.js reports : Node.js Inspector DNS rebinding vulnerability (CVE-2018-7160) Node.js 6.x and later include a debugger protocol (also known as 'inspector') that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. 'path' module regular expression denial of service (CVE-2018-7158) The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. Spaces in HTTP Content-Length header values are ignored (CVE-2018-7159) The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference.

ID	Name	Product	Family	Severity
194056	RHEL 7 : rh-nodejs8-nodejs (RHSA-2018:2949)	Nessus	Red Hat Local Security Checks	high
180827	Oracle Linux 7 : http-parser (ELSA-2019-2258)	Nessus	Oracle Linux Local Security Checks	medium
144260	Virtuozzo 7 : http-parser / http-parser-devel (VZLSA-2019-2258)	Nessus	Virtuozzo Local Security Checks	medium
137494	EulerOS 2.0 SP2 : http-parser (EulerOS-SA-2020-1652)	Nessus	Huawei Local Security Checks	medium
135935	Amazon Linux AMI : http-parser (ALAS-2020-1359)	Nessus	Amazon Linux Local Security Checks	critical
135648	EulerOS Virtualization 3.0.2.2 : http-parser (EulerOS-SA-2020-1486)	Nessus	Huawei Local Security Checks	medium
134487	EulerOS Virtualization for ARM 64 3.0.2.0 : http-parser (EulerOS-SA-2020-1198)	Nessus	Huawei Local Security Checks	medium
132435	NewStart CGSL CORE 5.05 / MAIN 5.05 : http-parser Multiple Vulnerabilities (NS-SA-2019-0257)	Nessus	NewStart CGSL Local Security Checks	medium
130867	EulerOS 2.0 SP5 : http-parser (EulerOS-SA-2019-2158)	Nessus	Huawei Local Security Checks	medium
130700	EulerOS 2.0 SP3 : http-parser (EulerOS-SA-2019-2238)	Nessus	Huawei Local Security Checks	medium
130219	Amazon Linux 2 : http-parser (ALAS-2019-1322)	Nessus	Amazon Linux Local Security Checks	medium
129916	NewStart CGSL CORE 5.04 / MAIN 5.04 : http-parser Multiple Vulnerabilities (NS-SA-2019-0208)	Nessus	NewStart CGSL Local Security Checks	medium
129307	F5 Networks BIG-IP : Node.js vulnerability (K27228191)	Nessus	F5 Networks Local Security Checks	medium
129016	CentOS 7 : http-parser (CESA-2019:2258)	Nessus	CentOS Local Security Checks	medium
128222	Scientific Linux Security Update : http-parser on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	medium
127700	RHEL 7 : http-parser (RHSA-2019:2258)	Nessus	Red Hat Local Security Checks	medium
120022	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2018:1183-1)	Nessus	SuSE Local Security Checks	high
120019	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2018:0952-1)	Nessus	SuSE Local Security Checks	medium
118933	Node.js multiple vulnerabilities (March 2018 Security Releases).	Nessus	Misc.	high
109717	openSUSE Security Update : nodejs6 (openSUSE-2018-444)	Nessus	SuSE Local Security Checks	high
109101	openSUSE Security Update : nodejs4 (openSUSE-2018-375)	Nessus	SuSE Local Security Checks	high
108738	FreeBSD : node.js -- multiple vulnerabilities (5a9bbb6e-32d3-11e8-a769-6daaba161086)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-7159

medium

Tenable Plugins

high

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

high

high

high

high