In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2939 advisory.

  - nodejs: Denial of Service with large HTTP headers (CVE-2018-12121)

  - nodejs: Slowloris HTTP Denial of Service (CVE-2018-12122)

  - nodejs: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)

  - nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass (CVE-2019-5737)

  - HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  - HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  - HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

  - HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  - HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

  - HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

  - HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

  - HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1821 advisory.

  - nodejs: HTTP request splitting (CVE-2018-12116)

  - nodejs: Denial of Service with large HTTP headers (CVE-2018-12121)

  - nodejs: Slowloris HTTP Denial of Service (CVE-2018-12122)

  - nodejs: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)

  - nodejs-tar: Arbitrary file overwrites when extracting tarballs containing a hard-link (CVE-2018-20834)

  - nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass (CVE-2019-5737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:2925 advisory.

  - In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1,     an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive     mode and by sending headers very slowly. This keeps the connection and associated resources alive for a     long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer.
    This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js     release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before     11.10.1. (CVE-2019-5737)

  - Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization     manipulation, potentially leading to a denial of service. The attacker requests a large amount of data     from a specified resource over multiple streams. They manipulate window size and stream priority to force     the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can     consume excess CPU, memory, or both. (CVE-2019-9511)

  - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
    (CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
    The attacker creates multiple request streams and continually shuffles the priority of the streams in a     way that causes substantial churn to the priority tree. This can consume excess CPU. (CVE-2019-9513)

  - Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both. (CVE-2019-9514)

  - Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of     service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer     reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in     behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory,     or both. (CVE-2019-9515)

  - Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
    The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally     Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and     keep the allocation alive until the session dies. This can consume excess memory. (CVE-2019-9516)

  - Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to     a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint;
    however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the     wire. The attacker then sends a stream of requests for a large response object. Depending on how the     servers queue the responses, this can consume excess memory, CPU, or both. (CVE-2019-9517)

  - Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of     service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag.
    These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each     frame disproportionate to attack bandwidth. This can consume excess CPU. (CVE-2019-9518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4796-1 advisory.

  - The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before     4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which     allows man-in-the-middle attackers to spoof servers via a crafted certificate. (CVE-2016-7099)

  - The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be     triggered to read memory outside of the given input buffer if the passed in DNS response packet was     crafted in a particular way. (CVE-2017-1000381)

  - In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by     Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused     to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of     a buffer cause a miscalculation of the maximum length of the input bytes to be written. (CVE-2018-12115)

  - Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be     convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then     data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the     same server. (CVE-2018-12116)

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of     Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or     HTTPS connections and associated resources alive for a long period of time. (CVE-2018-12122)

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser     for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that     hostname can be spoofed by using a mixed case javascript: (e.g. javAscript:) protocol (other protocols     are not affected). If security decisions are made about the URL based on the hostname, they may be     incorrect. (CVE-2018-12123)

  - The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited     to perform remote code execution. An attack is possible from malicious websites open in a web browser on     the same computer, or another computer with network access to the computer running the Node.js process. A     malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy     checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process     with the debug port active is running on localhost or on a host on the local network, the malicious     website could connect to it as a debugger, and get full code execution access. (CVE-2018-7160)

  - Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a     Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and     Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of     Node.js 6.x (LTS Boron), 8.x (LTS Carbon), and 9.x are vulnerable. All versions of Node.js 10.x     (Current) are NOT vulnerable. (CVE-2018-7167)

  - In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1,     an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive     mode and by sending headers very slowly. This keeps the connection and associated resources alive for a     long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer.
    This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js     release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before     11.10.1. (CVE-2019-5737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2925 advisory.

  - nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass (CVE-2019-5737)

  - HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  - HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  - HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

  - HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  - HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

  - HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

  - HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

  - HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-48 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly write arbitrary files, cause a Denial       of Service condition or can conduct HTTP request splitting attacks.
  Workaround :

    There is no known workaround at this time.

An update of the nodejs package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2925 advisory.

  - nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass (CVE-2019-5737)

  - HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  - HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  - HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

  - HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  - HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

  - HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

  - HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

  - HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs10 to version 10.1.2 fixes the following issue:
&#9; Security issue fixed :

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs6 to version 6.17.0 fixes the following issues :

Security issues fixed :

  - CVE-2019-5739: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127533).

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

  - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding     Oracle which under certain circumstances a TLS server     can be forced to respond differently to a client and     lead to the decryption of the data (bsc#1127080).

Release Notes: https://nodejs.org/en/blog/release/v6.17.0/ 

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs8 to version 8.15.1 fixes the following issue :

Security issue fixed :

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

This update was imported from the SUSE:SLE-15:Update update project.

This update for nodejs6 to version 6.17.0 fixes the following issues :

Security issues fixed :

CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533).

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).

Release Notes: https://nodejs.org/en/blog/release/v6.17.0/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 fixes the following issues :

Security issues fixed :

  - CVE-2019-5739: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127533).

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

  - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding     Oracle which under certain circumstances a TLS server     can be forced to respond differently to a client and     lead to the decryption of the data (bsc#1127080).&#9; 

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs4 fixes the following issues :

Security issues fixed :

CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533).

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs10 to version 10.1.2 fixes the following issue :

Security issue fixed :

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs8 to version 8.15.1 fixes the following issue :

Security issue fixed :

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs10 to versio 10.15.2 fixes the following issue :

Security issue fixed :

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Node.js reports :

Updates are now available for all active Node.js release lines. In addition to fixes for security flaws in Node.js, they also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2r which contains a fix for a moderate severity security vulnerability.

For these releases, we have decided to withhold the fix for the Misinterpretation of Input (CWE-115) flaw mentioned in the original announcement. This flaw is very low severity and we are not satisfied that we had a complete and stable fix ready for release. We will be seeking to address this flaw via alternate mechanisms in the near future. In addition, we have introduced an additional CVE for a change in Node.js 6 that we have decided to classify as a Denial of Service (CWE-400) flaw.

We recommend that all Node.js users upgrade to a version listed below as soon as possible. OpenSSL: 0-byte record padding oracle (CVE-2019-1559) OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only. Node.js 10 and 11 are not impacted by this vulnerability as they use newer versions of OpenSSL which do not contain the flaw.

Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid padding compared to a zero-byte record with an invalid MAC.
This can be used as the basis of a padding oracle attack to decrypt data.

Only TLS connections using certain ciphersuites executing under certain conditions are exploitable. We are currently unable to determine whether the use of OpenSSL in Node.js exposes this vulnerability. We are taking a cautionary approach and recommend the same for users. For more information, see the advisory and a detailed write-up by the reporters of the vulnerability.

ID	Name	Product	Family	Severity
194000	RHEL 7 : rh-nodejs10-nodejs (RHSA-2019:2939)	Nessus	Red Hat Local Security Checks	medium
193999	RHEL 7 : rh-nodejs8-nodejs (RHSA-2019:1821)	Nessus	Red Hat Local Security Checks	high
184969	Rocky Linux 8 : nodejs:10 (RLSA-2019:2925)	Nessus	Rocky Linux Local Security Checks	high
183156	Ubuntu 16.04 ESM / 18.04 ESM : Node.js vulnerabilities (USN-4796-1)	Nessus	Ubuntu Local Security Checks	high
145589	CentOS 8 : nodejs:10 (CESA-2019:2925)	Nessus	CentOS Local Security Checks	high
134776	GLSA-202003-48 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
132525	Photon OS 1.0: Nodejs PHSA-2019-1.0-0257	Nessus	PhotonOS Local Security Checks	high
129480	RHEL 8 : nodejs:10 (RHSA-2019:2925)	Nessus	Red Hat Local Security Checks	high
124104	openSUSE Security Update : nodejs10 (openSUSE-2019-1211)	Nessus	SuSE Local Security Checks	high
123919	openSUSE Security Update : nodejs6 (openSUSE-2019-1173)	Nessus	SuSE Local Security Checks	medium
123821	openSUSE Security Update : nodejs8 (openSUSE-2019-1167)	Nessus	SuSE Local Security Checks	high
123551	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2019:0818-1)	Nessus	SuSE Local Security Checks	medium
123495	openSUSE Security Update : nodejs4 (openSUSE-2019-1076)	Nessus	SuSE Local Security Checks	medium
122999	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2019:0658-1)	Nessus	SuSE Local Security Checks	medium
122965	SUSE SLES12 Security Update : nodejs10 (SUSE-SU-2019:0636-1)	Nessus	SuSE Local Security Checks	high
122964	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2019:0635-1)	Nessus	SuSE Local Security Checks	high
122944	SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2019:0627-1)	Nessus	SuSE Local Security Checks	high
122571	FreeBSD : Node.js -- multiple vulnerabilities (b71d7193-3c54-11e9-a3f9-00155d006b02)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-5737

high

Tenable Plugins

medium

high

high

high

high

critical

high

high

high

medium

high

medium

medium

medium

high

high

high

medium