Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:0579 advisory.

  - Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a     crafted X.509 certificate (CVE-2019-15604)

  - HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding     is malformed (CVE-2019-15605)

  - Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of     authorization based on header value comparisons (CVE-2019-15606)

  - Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for     packages to create symlinks to files outside of thenode_modules folder through the bin field upon     installation. A properly constructed entry in the package.json bin field would allow a package publisher     to create a symlink pointing to arbitrary files on a user's system when the package is installed. This     behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-     scripts install option. (CVE-2019-16775)

  - Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent     access to folders outside of the intended node_modules folder through the bin field. A properly     constructed entry in the package.json bin field would allow a package publisher to modify and/or gain     access to arbitrary files on a user's system when the package is installed. This behavior is still     possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install     option. (CVE-2019-16776)

  - Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent     existing globally-installed binaries to be overwritten by other package installations. For example, if a     package was installed globally and created a serve binary, any subsequent installs of packages that also     create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local     installations and also through install scripts. This vulnerability bypasses a user using the --ignore-     scripts install option. (CVE-2019-16777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:0598 advisory.

  - Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a     crafted X.509 certificate (CVE-2019-15604)

  - HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding     is malformed (CVE-2019-15605)

  - Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of     authorization based on header value comparisons (CVE-2019-15606)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6380-1 advisory.

    Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

    (CVE-2019-15604)

    Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2019-15605)

    Alyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a user or an automated system     were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue     to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2019-15606)

    Tobias Niessen discovered that Node.js incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2020-8174)

    It was discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     cause a denial of service. (CVE-2020-8265, CVE-2020-8287)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0602 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.16.1).

    Security Fix(es):

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

    * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)

    * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

    * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

    * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

    * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0597 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.19.0).

    Security Fix(es):

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

    * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)

    * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

    * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

    * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

    * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0579 advisory.

  - nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  - nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  - nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

  - npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

  - npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

  - npm: Global node_modules Binary Overwrite (CVE-2019-16777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0598 advisory.

  - nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  - nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  - nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0598 advisory.

    nodejs     [1:12.16.1-1]
    - Resolves: RHBZ#1800393, RHBZ#1800394, RHBZ#1800380
    - Rebase to 12.16.1

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0579 advisory.

    - Rebase to 10.19.0 to fix CVE-2019-15604 to CVE-2019-15606
    - Rebase to 10.16.3 to fix CVE-2019-9511 to CVE-2019-9518

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in Node.js, which could result in denial of service or HTTP request smuggling.

An update of the nodejs10 package has been released.

The remote host is affected by the vulnerability described in GLSA-202003-48 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly write arbitrary files, cause a Denial       of Service condition or can conduct HTTP request splitting attacks.
  Workaround :

    There is no known workaround at this time.

Node.js reports :

Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605) Affected Node.js versions can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system.
HTTP header values do not have trailing OWS trimmed (High) (CVE-2019-15606) Optional whitespace should be trimmed from HTTP header values. Its presence may allow attackers to bypass security checks based on HTTP header values. Remotely trigger an assertion on a TLS server with a malformed certificate string (High) (CVE-2019-15604) Connecting to a NodeJS TLS server with a client certificate that has a type 19 string in its subjectAltName will crash the TLS server if it tries to read the peer certificate. Strict HTTP header parsing (None) Increase the strictness of HTTP header parsing. There are no known vulnerabilities addressed, but lax HTTP parsing has historically been a source of problems. Some commonly used sites are known to generate invalid HTTP headers, a --insecure-http-parser CLI option or insecureHTTPParser http option can be used if necessary for interoperability, but is not recommended.

This update for nodejs8 fixes the following issues :

Security issues fixed :

  - CVE-2019-15604: Fixed a remotely triggerable assertion     in the TLS server via a crafted certificate string     (CVE-2019-15604, bsc#1163104).

  - CVE-2019-15605: Fixed an HTTP request smuggling     vulnerability via malformed Transfer-Encoding header     (CVE-2019-15605, bsc#1163102).

  - CVE-2019-15606: Fixed the white space sanitation of HTTP     headers (CVE-2019-15606, bsc#1163103).

This update was imported from the SUSE:SLE-15:Update update project.

This update for nodejs6 fixes the following issues :

Security issues fixed :

CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).

CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).

CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs10 fixes the following issues :

nodejs10 was updated to version 10.19.0.

Security issues fixed :

CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).

CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).

CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs8 fixes the following issues :

Security issues fixed :

CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).

CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).

CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0598 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.16.1).

    Security Fix(es):

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

    * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)

    * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0579 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

    Security Fix(es):

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

    * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)

    * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

    * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

    * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

    * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0573 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

    Security Fix(es):

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

    * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)

    * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

    * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

    * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

    * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

This update for nodejs12 fixes the following issues :

nodejs12 was updated to version 12.15.0.

Security issues fixed :

CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).

CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).

CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).

CVE-2019-16775: Fixed an arbitrary file write vulnerability (bsc#1159352).

CVE-2019-16776: Fixed an arbitrary file write vulnerability (bsc#1159352).

CVE-2019-16777: Fixed an arbitrary file write vulnerability (bsc#1159352).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184706	Rocky Linux 8 : nodejs:10 (RLSA-2020:0579)	Nessus	Rocky Linux Local Security Checks	critical
184480	Rocky Linux 8 : nodejs:12 (RLSA-2020:0598)	Nessus	Rocky Linux Local Security Checks	critical
181613	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : Node.js vulnerabilities (USN-6380-1)	Nessus	Ubuntu Local Security Checks	critical
170354	RHEL 7 : rh-nodejs12-nodejs (RHSA-2020:0602)	Nessus	Red Hat Local Security Checks	critical
170312	RHEL 7 : rh-nodejs10-nodejs (RHSA-2020:0597)	Nessus	Red Hat Local Security Checks	critical
145979	CentOS 8 : nodejs:10 (CESA-2020:0579)	Nessus	CentOS Local Security Checks	critical
145796	CentOS 8 : nodejs:12 (CESA-2020:0598)	Nessus	CentOS Local Security Checks	critical
140036	Oracle Linux 8 : nodejs:12 (ELSA-2020-0598)	Nessus	Oracle Linux Local Security Checks	critical
140035	Oracle Linux 8 : nodejs:10 (ELSA-2020-0579)	Nessus	Oracle Linux Local Security Checks	critical
136126	Debian DSA-4669-1 : nodejs - security update (Data Dribble) (Reset Flood) (Resource Loop)	Nessus	Debian Local Security Checks	critical
136036	Photon OS 1.0: Nodejs10 PHSA-2020-1.0-0289	Nessus	PhotonOS Local Security Checks	critical
134776	GLSA-202003-48 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
134356	FreeBSD : Node.js -- multiple vulnerabilities (0032400f-624f-11ea-b495-000d3ab229d6)	Nessus	FreeBSD Local Security Checks	critical
134281	openSUSE Security Update : nodejs8 (openSUSE-2020-293)	Nessus	SuSE Local Security Checks	critical
134100	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2020:0488-1)	Nessus	SuSE Local Security Checks	critical
134075	SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2020:0455-1)	Nessus	SuSE Local Security Checks	critical
134074	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2020:0454-1)	Nessus	SuSE Local Security Checks	critical
134068	RHEL 8 : nodejs:12 (RHSA-2020:0598)	Nessus	Red Hat Local Security Checks	critical
134062	RHEL 8 : nodejs:10 (RHSA-2020:0579)	Nessus	Red Hat Local Security Checks	critical
134028	RHEL 8 : nodejs:10 (RHSA-2020:0573)	Nessus	Red Hat Local Security Checks	critical
133956	Photon OS 3.0: Nodejs PHSA-2020-3.0-0060	Nessus	PhotonOS Local Security Checks	critical
133947	SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2020:0429-1)	Nessus	SuSE Local Security Checks	critical
133946	SUSE SLES12 Security Update : nodejs10 (SUSE-SU-2020:0427-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-15604

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical