Vulnerability-Lookup

SUSE-SU-2019:0658-1

Vulnerability from csaf_suse - Published: 2019-03-20 13:32 - Updated: 2019-03-20 13:32

Summary

Security update for nodejs4

Severity

Moderate

Notes

Title of the patch: Security update for nodejs4

Description of the patch: This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533). - CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532). - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).

Patchnames: SUSE-2019-658,SUSE-SLE-Module-Web-Scripting-12-2019-658,SUSE-Storage-4-2019-658

CVE-2019-1559

4 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2019-5737

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2019-1559

Threats

Impact moderate

CVE-2019-5739

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2019-1559

Threats

Impact moderate

References

18 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1127080	self
https://bugzilla.suse.com/1127532	self
https://bugzilla.suse.com/1127533	self
https://www.suse.com/security/cve/CVE-2019-1559/	self
https://www.suse.com/security/cve/CVE-2019-5737/	self
https://www.suse.com/security/cve/CVE-2019-5739/	self
https://www.suse.com/security/cve/CVE-2019-1559	external
https://bugzilla.suse.com/1127080	external
https://bugzilla.suse.com/1130039	external
https://bugzilla.suse.com/1141798	external
https://www.suse.com/security/cve/CVE-2019-5737	external
https://bugzilla.suse.com/1127532	external
https://www.suse.com/security/cve/CVE-2019-5739	external
https://bugzilla.suse.com/1127533	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nodejs4",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nodejs4 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service \n  when HTTP connection are kept active (bsc#1127533).\n- CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service\n  when HTTP connection are kept active (bsc#1127532).\n- CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances \n  a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).\t  \n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2019-658,SUSE-SLE-Module-Web-Scripting-12-2019-658,SUSE-Storage-4-2019-658",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_0658-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2019:0658-1",
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20190658-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2019:0658-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2019-March/005212.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1127080",
        "url": "https://bugzilla.suse.com/1127080"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1127532",
        "url": "https://bugzilla.suse.com/1127532"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1127533",
        "url": "https://bugzilla.suse.com/1127533"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-1559 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-1559/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-5737 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-5737/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-5739 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-5739/"
      }
    ],
    "title": "Security update for nodejs4",
    "tracking": {
      "current_release_date": "2019-03-20T13:32:01Z",
      "generator": {
        "date": "2019-03-20T13:32:01Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2019:0658-1",
      "initial_release_date": "2019-03-20T13:32:01Z",
      "revision_history": [
        {
          "date": "2019-03-20T13:32:01Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs4-4.9.1-15.20.1.aarch64",
                "product": {
                  "name": "nodejs4-4.9.1-15.20.1.aarch64",
                  "product_id": "nodejs4-4.9.1-15.20.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs4-devel-4.9.1-15.20.1.aarch64",
                "product": {
                  "name": "nodejs4-devel-4.9.1-15.20.1.aarch64",
                  "product_id": "nodejs4-devel-4.9.1-15.20.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "npm4-4.9.1-15.20.1.aarch64",
                "product": {
                  "name": "npm4-4.9.1-15.20.1.aarch64",
                  "product_id": "npm4-4.9.1-15.20.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs4-4.9.1-15.20.1.i586",
                "product": {
                  "name": "nodejs4-4.9.1-15.20.1.i586",
                  "product_id": "nodejs4-4.9.1-15.20.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs4-devel-4.9.1-15.20.1.i586",
                "product": {
                  "name": "nodejs4-devel-4.9.1-15.20.1.i586",
                  "product_id": "nodejs4-devel-4.9.1-15.20.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "npm4-4.9.1-15.20.1.i586",
                "product": {
                  "name": "npm4-4.9.1-15.20.1.i586",
                  "product_id": "npm4-4.9.1-15.20.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs4-docs-4.9.1-15.20.1.noarch",
                "product": {
                  "name": "nodejs4-docs-4.9.1-15.20.1.noarch",
                  "product_id": "nodejs4-docs-4.9.1-15.20.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs4-4.9.1-15.20.1.ppc64le",
                "product": {
                  "name": "nodejs4-4.9.1-15.20.1.ppc64le",
                  "product_id": "nodejs4-4.9.1-15.20.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs4-devel-4.9.1-15.20.1.ppc64le",
                "product": {
                  "name": "nodejs4-devel-4.9.1-15.20.1.ppc64le",
                  "product_id": "nodejs4-devel-4.9.1-15.20.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "npm4-4.9.1-15.20.1.ppc64le",
                "product": {
                  "name": "npm4-4.9.1-15.20.1.ppc64le",
                  "product_id": "npm4-4.9.1-15.20.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs4-4.9.1-15.20.1.x86_64",
                "product": {
                  "name": "nodejs4-4.9.1-15.20.1.x86_64",
                  "product_id": "nodejs4-4.9.1-15.20.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs4-devel-4.9.1-15.20.1.x86_64",
                "product": {
                  "name": "nodejs4-devel-4.9.1-15.20.1.x86_64",
                  "product_id": "nodejs4-devel-4.9.1-15.20.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm4-4.9.1-15.20.1.x86_64",
                "product": {
                  "name": "npm4-4.9.1-15.20.1.x86_64",
                  "product_id": "npm4-4.9.1-15.20.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Web and Scripting 12",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Web and Scripting 12",
                  "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-web-scripting:12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 4",
                "product": {
                  "name": "SUSE Enterprise Storage 4",
                  "product_id": "SUSE Enterprise Storage 4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs4-4.9.1-15.20.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64"
        },
        "product_reference": "nodejs4-4.9.1-15.20.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs4-4.9.1-15.20.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le"
        },
        "product_reference": "nodejs4-4.9.1-15.20.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs4-4.9.1-15.20.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64"
        },
        "product_reference": "nodejs4-4.9.1-15.20.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs4-devel-4.9.1-15.20.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64"
        },
        "product_reference": "nodejs4-devel-4.9.1-15.20.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs4-devel-4.9.1-15.20.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le"
        },
        "product_reference": "nodejs4-devel-4.9.1-15.20.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs4-devel-4.9.1-15.20.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64"
        },
        "product_reference": "nodejs4-devel-4.9.1-15.20.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs4-docs-4.9.1-15.20.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch"
        },
        "product_reference": "nodejs4-docs-4.9.1-15.20.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm4-4.9.1-15.20.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64"
        },
        "product_reference": "npm4-4.9.1-15.20.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm4-4.9.1-15.20.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le"
        },
        "product_reference": "npm4-4.9.1-15.20.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm4-4.9.1-15.20.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64"
        },
        "product_reference": "npm4-4.9.1-15.20.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs4-4.9.1-15.20.1.aarch64 as component of SUSE Enterprise Storage 4",
          "product_id": "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64"
        },
        "product_reference": "nodejs4-4.9.1-15.20.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs4-4.9.1-15.20.1.x86_64 as component of SUSE Enterprise Storage 4",
          "product_id": "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64"
        },
        "product_reference": "nodejs4-4.9.1-15.20.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-1559",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-1559"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64",
          "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-1559",
          "url": "https://www.suse.com/security/cve/CVE-2019-1559"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1127080 for CVE-2019-1559",
          "url": "https://bugzilla.suse.com/1127080"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1130039 for CVE-2019-1559",
          "url": "https://bugzilla.suse.com/1130039"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141798 for CVE-2019-1559",
          "url": "https://bugzilla.suse.com/1141798"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-03-20T13:32:01Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-1559"
    },
    {
      "cve": "CVE-2019-5737",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-5737"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64",
          "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-5737",
          "url": "https://www.suse.com/security/cve/CVE-2019-5737"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1127532 for CVE-2019-5737",
          "url": "https://bugzilla.suse.com/1127532"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-03-20T13:32:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-5737"
    },
    {
      "cve": "CVE-2019-5739",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-5739"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64",
          "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-5739",
          "url": "https://www.suse.com/security/cve/CVE-2019-5739"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1127533 for CVE-2019-5739",
          "url": "https://bugzilla.suse.com/1127533"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Enterprise Storage 4:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.9.1-15.20.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.9.1-15.20.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.9.1-15.20.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-03-20T13:32:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-5739"
    }
  ]
}

CVE-2019-1559 (GCVE-0-2019-1559)

Vulnerability from cvelistv5 – Published: 2019-02-27 23:00 – Updated: 2024-09-17 04:20

Title

0-byte record padding oracle

Summary

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

Severity

No CVSS data available.

CWE

Padding Oracle

Assigner

openssl mitre root

References

36 references

URL	Tags
http://www.securityfocus.com/bid/107174	vdb-entryx_refsource_BID
https://security.gentoo.org/glsa/201903-10	vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/3899-1/	vendor-advisoryx_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2019/dsa-4400	vendor-advisoryx_refsource_DEBIAN
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2304	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2439	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2437	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2471	vendor-advisoryx_refsource_REDHAT
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://access.redhat.com/errata/RHSA-2019:3929	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:3931	vendor-advisoryx_refsource_REDHAT
https://www.oracle.com/technetwork/security-advis…	x_refsource_MISC
https://www.oracle.com/technetwork/security-advis…	x_refsource_MISC
https://www.oracle.com/technetwork/security-advis…	x_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC
https://usn.ubuntu.com/4376-2/	vendor-advisoryx_refsource_UBUNTU
https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2019030…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2019030…	x_refsource_CONFIRM
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…	x_refsource_CONFIRM
https://www.openssl.org/news/secadv/20190226.txt	x_refsource_CONFIRM
https://support.f5.com/csp/article/K18549143	x_refsource_CONFIRM
https://www.tenable.com/security/tns-2019-02	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2019042…	x_refsource_CONFIRM
https://www.tenable.com/security/tns-2019-03	x_refsource_CONFIRM
https://kc.mcafee.com/corporate/index?page=conten…	x_refsource_CONFIRM
https://support.f5.com/csp/article/K18549143?utm_…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)

Date Public

2019-02-26 00:00

Credits

Juraj Somorovsky, Robert Merget and Nimrod Aviram, with additional investigation by Steven Collison and Andrew Hourselt

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:20:27.982Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "107174",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107174"
          },
          {
            "name": "GLSA-201903-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201903-10"
          },
          {
            "name": "USN-3899-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3899-1/"
          },
          {
            "name": "[debian-lts-announce] 20190301 [SECURITY] [DLA 1701-1] openssl security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html"
          },
          {
            "name": "DSA-4400",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4400"
          },
          {
            "name": "openSUSE-SU-2019:1076",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
          },
          {
            "name": "openSUSE-SU-2019:1105",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html"
          },
          {
            "name": "openSUSE-SU-2019:1173",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
          },
          {
            "name": "openSUSE-SU-2019:1175",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html"
          },
          {
            "name": "openSUSE-SU-2019:1432",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html"
          },
          {
            "name": "openSUSE-SU-2019:1637",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html"
          },
          {
            "name": "RHSA-2019:2304",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2304"
          },
          {
            "name": "RHSA-2019:2439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2439"
          },
          {
            "name": "RHSA-2019:2437",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2437"
          },
          {
            "name": "RHSA-2019:2471",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2471"
          },
          {
            "name": "FEDORA-2019-db06efdea1",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/"
          },
          {
            "name": "FEDORA-2019-00c25b9379",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/"
          },
          {
            "name": "FEDORA-2019-9a0a7c0986",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/"
          },
          {
            "name": "RHSA-2019:3929",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3929"
          },
          {
            "name": "RHSA-2019:3931",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3931"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "USN-4376-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4376-2/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190301-0001/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190301-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20190226.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K18549143"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2019-02"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190423-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2019-03"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10282"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K18549143?utm_source=f5support\u0026amp%3Butm_medium=RSS"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Juraj Somorovsky, Robert Merget and Nimrod Aviram, with additional investigation by Steven Collison and Andrew Hourselt"
        }
      ],
      "datePublic": "2019-02-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "lang": "eng",
              "url": "https://www.openssl.org/policies/secpolicy.html#Moderate",
              "value": "Moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Padding Oracle",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-20T14:42:01.000Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "107174",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107174"
        },
        {
          "name": "GLSA-201903-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201903-10"
        },
        {
          "name": "USN-3899-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3899-1/"
        },
        {
          "name": "[debian-lts-announce] 20190301 [SECURITY] [DLA 1701-1] openssl security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html"
        },
        {
          "name": "DSA-4400",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4400"
        },
        {
          "name": "openSUSE-SU-2019:1076",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
        },
        {
          "name": "openSUSE-SU-2019:1105",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html"
        },
        {
          "name": "openSUSE-SU-2019:1173",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
        },
        {
          "name": "openSUSE-SU-2019:1175",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html"
        },
        {
          "name": "openSUSE-SU-2019:1432",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html"
        },
        {
          "name": "openSUSE-SU-2019:1637",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html"
        },
        {
          "name": "RHSA-2019:2304",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2304"
        },
        {
          "name": "RHSA-2019:2439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2439"
        },
        {
          "name": "RHSA-2019:2437",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2437"
        },
        {
          "name": "RHSA-2019:2471",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2471"
        },
        {
          "name": "FEDORA-2019-db06efdea1",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/"
        },
        {
          "name": "FEDORA-2019-00c25b9379",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/"
        },
        {
          "name": "FEDORA-2019-9a0a7c0986",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/"
        },
        {
          "name": "RHSA-2019:3929",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3929"
        },
        {
          "name": "RHSA-2019:3931",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3931"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "USN-4376-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4376-2/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190301-0001/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190301-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.openssl.org/news/secadv/20190226.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K18549143"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2019-02"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190423-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2019-03"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10282"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K18549143?utm_source=f5support\u0026amp%3Butm_medium=RSS"
        }
      ],
      "title": "0-byte record padding oracle",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "openssl-security@openssl.org",
          "DATE_PUBLIC": "2019-02-26",
          "ID": "CVE-2019-1559",
          "STATE": "PUBLIC",
          "TITLE": "0-byte record padding oracle"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OpenSSL",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "OpenSSL"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Juraj Somorovsky, Robert Merget and Nimrod Aviram, with additional investigation by Steven Collison and Andrew Hourselt"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."
            }
          ]
        },
        "impact": [
          {
            "lang": "eng",
            "url": "https://www.openssl.org/policies/secpolicy.html#Moderate",
            "value": "Moderate"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Padding Oracle"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "107174",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107174"
            },
            {
              "name": "GLSA-201903-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201903-10"
            },
            {
              "name": "USN-3899-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3899-1/"
            },
            {
              "name": "[debian-lts-announce] 20190301 [SECURITY] [DLA 1701-1] openssl security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html"
            },
            {
              "name": "DSA-4400",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4400"
            },
            {
              "name": "openSUSE-SU-2019:1076",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
            },
            {
              "name": "openSUSE-SU-2019:1105",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html"
            },
            {
              "name": "openSUSE-SU-2019:1173",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
            },
            {
              "name": "openSUSE-SU-2019:1175",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html"
            },
            {
              "name": "openSUSE-SU-2019:1432",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html"
            },
            {
              "name": "openSUSE-SU-2019:1637",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html"
            },
            {
              "name": "RHSA-2019:2304",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2304"
            },
            {
              "name": "RHSA-2019:2439",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2439"
            },
            {
              "name": "RHSA-2019:2437",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2437"
            },
            {
              "name": "RHSA-2019:2471",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2471"
            },
            {
              "name": "FEDORA-2019-db06efdea1",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/"
            },
            {
              "name": "FEDORA-2019-00c25b9379",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/"
            },
            {
              "name": "FEDORA-2019-9a0a7c0986",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/"
            },
            {
              "name": "RHSA-2019:3929",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3929"
            },
            {
              "name": "RHSA-2019:3931",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3931"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "USN-4376-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4376-2/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190301-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190301-0001/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190301-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190301-0002/"
            },
            {
              "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e",
              "refsource": "CONFIRM",
              "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e"
            },
            {
              "name": "https://www.openssl.org/news/secadv/20190226.txt",
              "refsource": "CONFIRM",
              "url": "https://www.openssl.org/news/secadv/20190226.txt"
            },
            {
              "name": "https://support.f5.com/csp/article/K18549143",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K18549143"
            },
            {
              "name": "https://www.tenable.com/security/tns-2019-02",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2019-02"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190423-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190423-0002/"
            },
            {
              "name": "https://www.tenable.com/security/tns-2019-03",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2019-03"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10282",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10282"
            },
            {
              "name": "https://support.f5.com/csp/article/K18549143?utm_source=f5support\u0026amp;utm_medium=RSS",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K18549143?utm_source=f5support\u0026amp;utm_medium=RSS"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2019-1559",
    "datePublished": "2019-02-27T23:00:00.000Z",
    "dateReserved": "2018-11-28T00:00:00.000Z",
    "dateUpdated": "2024-09-17T04:20:35.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-5737 (GCVE-0-2019-5737)

Vulnerability from cvelistv5 – Published: 2019-03-28 16:20 – Updated: 2024-08-04 20:01

Summary

In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.

Severity

No CVSS data available.

CWE

CWE-400 - Uncontrolled Resource Consumption / Denial of Service

Assigner

nodejs mitre root

References

7 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/february…	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://security.netapp.com/advisory/ntap-2019050…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2019:1821	vendor-advisoryx_refsource_REDHAT
https://security.gentoo.org/glsa/202003-48	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Node.js	Node.js	Affected: All versions prior to 6.17.0 Affected: All versions prior to 8.15.1 Affected: All versions prior to 10.15.2 Affected: All versions prior to 11.10.1

Date Public

2019-02-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:01:52.386Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
          },
          {
            "name": "openSUSE-SU-2019:1076",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
          },
          {
            "name": "openSUSE-SU-2019:1173",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
          },
          {
            "name": "openSUSE-SU-2019:1211",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
          },
          {
            "name": "RHSA-2019:1821",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1821"
          },
          {
            "name": "GLSA-202003-48",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-48"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Node.js",
          "vendor": "Node.js",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 6.17.0"
            },
            {
              "status": "affected",
              "version": "All versions prior to 8.15.1"
            },
            {
              "status": "affected",
              "version": "All versions prior to 10.15.2"
            },
            {
              "status": "affected",
              "version": "All versions prior to 11.10.1"
            }
          ]
        }
      ],
      "datePublic": "2019-02-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption / Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-20T20:06:11.000Z",
        "orgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558",
        "shortName": "nodejs"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
        },
        {
          "name": "openSUSE-SU-2019:1076",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
        },
        {
          "name": "openSUSE-SU-2019:1173",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
        },
        {
          "name": "openSUSE-SU-2019:1211",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
        },
        {
          "name": "RHSA-2019:1821",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1821"
        },
        {
          "name": "GLSA-202003-48",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-48"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-request@iojs.org",
          "ID": "CVE-2019-5737",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Node.js",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to 6.17.0"
                          },
                          {
                            "version_value": "All versions prior to 8.15.1"
                          },
                          {
                            "version_value": "All versions prior to 10.15.2"
                          },
                          {
                            "version_value": "All versions prior to 11.10.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Node.js"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400: Uncontrolled Resource Consumption / Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/",
              "refsource": "MISC",
              "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
            },
            {
              "name": "openSUSE-SU-2019:1076",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
            },
            {
              "name": "openSUSE-SU-2019:1173",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
            },
            {
              "name": "openSUSE-SU-2019:1211",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190502-0008/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
            },
            {
              "name": "RHSA-2019:1821",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1821"
            },
            {
              "name": "GLSA-202003-48",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-48"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558",
    "assignerShortName": "nodejs",
    "cveId": "CVE-2019-5737",
    "datePublished": "2019-03-28T16:20:28.000Z",
    "dateReserved": "2019-01-09T00:00:00.000Z",
    "dateUpdated": "2024-08-04T20:01:52.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-5739 (GCVE-0-2019-5739)

Vulnerability from cvelistv5 – Published: 2019-03-28 16:27 – Updated: 2024-08-04 20:01

Summary

Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.

Severity

No CVSS data available.

CWE

CWE-400 - Uncontrolled Resource Consumption / Denial of Service

Assigner

nodejs mitre root

References

5 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/february…	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://security.netapp.com/advisory/ntap-2019050…	x_refsource_CONFIRM
https://security.gentoo.org/glsa/202003-48	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Node.js	Node.js	Affected: All versions prior to 6.17.0

Date Public

2019-02-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:01:52.297Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
          },
          {
            "name": "openSUSE-SU-2019:1076",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
          },
          {
            "name": "openSUSE-SU-2019:1173",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
          },
          {
            "name": "GLSA-202003-48",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-48"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Node.js",
          "vendor": "Node.js",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 6.17.0"
            }
          ]
        }
      ],
      "datePublic": "2019-02-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption / Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-20T20:06:15.000Z",
        "orgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558",
        "shortName": "nodejs"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
        },
        {
          "name": "openSUSE-SU-2019:1076",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
        },
        {
          "name": "openSUSE-SU-2019:1173",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
        },
        {
          "name": "GLSA-202003-48",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-48"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-request@iojs.org",
          "ID": "CVE-2019-5739",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Node.js",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to 6.17.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Node.js"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400: Uncontrolled Resource Consumption / Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/",
              "refsource": "MISC",
              "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
            },
            {
              "name": "openSUSE-SU-2019:1076",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
            },
            {
              "name": "openSUSE-SU-2019:1173",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190502-0008/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
            },
            {
              "name": "GLSA-202003-48",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-48"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558",
    "assignerShortName": "nodejs",
    "cveId": "CVE-2019-5739",
    "datePublished": "2019-03-28T16:27:34.000Z",
    "dateReserved": "2019-01-09T00:00:00.000Z",
    "dateUpdated": "2024-08-04T20:01:52.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2019:0658-1

CVE-2019-1559 (GCVE-0-2019-1559)

CVE-2019-5737 (GCVE-0-2019-5737)

CVE-2019-5739 (GCVE-0-2019-5739)

Tags

Sightings

Nomenclature

Related by attack behaviour