In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.

An update of the nodejs package has been released.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2939 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.16.3).

    Security Fix(es):

    * HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

    * HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

    * HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

    * HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

    * HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

    * HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1821 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs8-nodejs (8.16.0).
    (BZ#1665986, BZ#1710734)

    Security Fix(es):

    * nodejs-tar: Arbitrary file overwrites when extracting tarballs containing a hard-link (CVE-2018-20834)

    * nodejs: HTTP request splitting (CVE-2018-12116)

    * nodejs: Denial of Service with large HTTP headers (CVE-2018-12121)

    * nodejs: Slowloris HTTP Denial of Service (CVE-2018-12122)

    * nodejs: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)

    * nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass (CVE-2019-5737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:2925 advisory.

  - In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1,     an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive     mode and by sending headers very slowly. This keeps the connection and associated resources alive for a     long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer.
    This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js     release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before     11.10.1. (CVE-2019-5737)

  - Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization     manipulation, potentially leading to a denial of service. The attacker requests a large amount of data     from a specified resource over multiple streams. They manipulate window size and stream priority to force     the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can     consume excess CPU, memory, or both. (CVE-2019-9511)

  - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
    (CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
    The attacker creates multiple request streams and continually shuffles the priority of the streams in a     way that causes substantial churn to the priority tree. This can consume excess CPU. (CVE-2019-9513)

  - Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both. (CVE-2019-9514)

  - Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of     service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer     reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in     behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory,     or both. (CVE-2019-9515)

  - Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
    The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally     Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and     keep the allocation alive until the session dies. This can consume excess memory. (CVE-2019-9516)

  - Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to     a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint;
    however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the     wire. The attacker then sends a stream of requests for a large response object. Depending on how the     servers queue the responses, this can consume excess memory, CPU, or both. (CVE-2019-9517)

  - Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of     service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag.
    These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each     frame disproportionate to attack bandwidth. This can consume excess CPU. (CVE-2019-9518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4796-1 advisory.

    Alexander Minozhenko and James Bunton discovered that Node.js did not properly handle wildcards in name     fields of X.509 TLS certificates. An attacker could use this vulnerability to execute a machine-in-the-     middle- attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)

    It was discovered that Node.js incorrectly handled certain NAPTR responses. A remote attacker could     possibly use this issue to cause applications using Node.js to crash, resulting in a denial of service.
    This issue only affected Ubuntu 16.04 ESM. (CVE-2017-1000381)

    Nikita Skovoroda discovered that Node.js mishandled certain input, leading to an out of bounds write. An     attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary     code. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12115)

    Arkadiy Tetelman discovered that Node.js improperly handled certain malformed HTTP requests. An attacker     could use this vulnerability to inject unexpected HTTP requests. This issue only affected Ubuntu 18.04     ESM. (CVE-2018-12116)

    Jan Maybach discovered that Node.js did not time out if incomplete HTTP/HTTPS headers were received. An     attacker could use this vulnerability to cause a denial of service by keeping HTTP/HTTPS connections alive     for a long period of time. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12122)

    Martin Bajanik discovered that the url.parse() method would return incorrect results if it received     specially crafted input. An attacker could use this vulnerability to spoof the hostname and bypass     hostname-specific security controls. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12123)

    It was discovered that Node.js is vulnerable to a DNS rebinding attack which could be exploited to perform     remote code execution. An attack is possible from malicious websites open in a web browser with network     access to the system running the Node.js process. This issue only affected Ubuntu 18.04 ESM.
    (CVE-2018-7160)

    It was discovered that the Buffer.fill() and Buffer.alloc() methods improperly handled certain inputs. An     attacker could use this vulnerability to cause a denial of service. This issue only affected Ubuntu 18.04     ESM. (CVE-2018-7167)

    Marco Pracucci discovered that Node.js mishandled HTTP and HTTPS connections. An attacker could use this     vulnerability to cause a denial of service. This issue only affected Ubuntu 18.04 ESM. (CVE-2019-5737)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2925 advisory.

  - nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass (CVE-2019-5737)

  - HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  - HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  - HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

  - HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  - HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

  - HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

  - HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

  - HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-48 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly write arbitrary files, cause a Denial       of Service condition or can conduct HTTP request splitting attacks.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2925 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.16.3).

    Security Fix(es):

    * HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

    * HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

    * HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

    * HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

    * HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

    * HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs10 to version 10.1.2 fixes the following issue:
&#9; Security issue fixed :

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs6 to version 6.17.0 fixes the following issues :

Security issues fixed :

  - CVE-2019-5739: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127533).

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

  - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding     Oracle which under certain circumstances a TLS server     can be forced to respond differently to a client and     lead to the decryption of the data (bsc#1127080).

Release Notes: https://nodejs.org/en/blog/release/v6.17.0/ 

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs8 to version 8.15.1 fixes the following issue :

Security issue fixed :

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

This update was imported from the SUSE:SLE-15:Update update project.

This update for nodejs6 to version 6.17.0 fixes the following issues :

Security issues fixed :

CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533).

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).

Release Notes: https://nodejs.org/en/blog/release/v6.17.0/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 fixes the following issues :

Security issues fixed :

  - CVE-2019-5739: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127533).

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

  - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding     Oracle which under certain circumstances a TLS server     can be forced to respond differently to a client and     lead to the decryption of the data (bsc#1127080).&#9; 

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs4 fixes the following issues :

Security issues fixed :

CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533).

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs10 to version 10.1.2 fixes the following issue :

Security issue fixed :

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs8 to version 8.15.1 fixes the following issue :

Security issue fixed :

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs10 to versio 10.15.2 fixes the following issue :

Security issue fixed :

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Node.js reports :

Updates are now available for all active Node.js release lines. In addition to fixes for security flaws in Node.js, they also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2r which contains a fix for a moderate severity security vulnerability.

For these releases, we have decided to withhold the fix for the Misinterpretation of Input (CWE-115) flaw mentioned in the original announcement. This flaw is very low severity and we are not satisfied that we had a complete and stable fix ready for release. We will be seeking to address this flaw via alternate mechanisms in the near future. In addition, we have introduced an additional CVE for a change in Node.js 6 that we have decided to classify as a Denial of Service (CWE-400) flaw.

We recommend that all Node.js users upgrade to a version listed below as soon as possible. OpenSSL: 0-byte record padding oracle (CVE-2019-1559) OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only. Node.js 10 and 11 are not impacted by this vulnerability as they use newer versions of OpenSSL which do not contain the flaw.

Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid padding compared to a zero-byte record with an invalid MAC.
This can be used as the basis of a padding oracle attack to decrypt data.

Only TLS connections using certain ciphersuites executing under certain conditions are exploitable. We are currently unable to determine whether the use of OpenSSL in Node.js exposes this vulnerability. We are taking a cautionary approach and recommend the same for users. For more information, see the advisory and a detailed write-up by the reporters of the vulnerability.

ID	Name	Product	Family	Severity
202854	Photon OS 2.0: Nodejs PHSA-2019-2.0-0190	Nessus	PhotonOS Local Security Checks	high
194000	RHEL 7 : rh-nodejs10-nodejs (RHSA-2019:2939)	Nessus	Red Hat Local Security Checks	medium
193999	RHEL 7 : rh-nodejs8-nodejs (RHSA-2019:1821)	Nessus	Red Hat Local Security Checks	high
184969	Rocky Linux 8 : nodejs:10 (RLSA-2019:2925)	Nessus	Rocky Linux Local Security Checks	high
183156	Ubuntu 16.04 ESM / 18.04 ESM : Node.js vulnerabilities (USN-4796-1)	Nessus	Ubuntu Local Security Checks	high
145589	CentOS 8 : nodejs:10 (CESA-2019:2925)	Nessus	CentOS Local Security Checks	high
134776	GLSA-202003-48 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
132525	Photon OS 1.0: Nodejs PHSA-2019-1.0-0257	Nessus	PhotonOS Local Security Checks	high
129480	RHEL 8 : nodejs:10 (RHSA-2019:2925)	Nessus	Red Hat Local Security Checks	high
124104	openSUSE Security Update : nodejs10 (openSUSE-2019-1211)	Nessus	SuSE Local Security Checks	high
123919	openSUSE Security Update : nodejs6 (openSUSE-2019-1173)	Nessus	SuSE Local Security Checks	medium
123821	openSUSE Security Update : nodejs8 (openSUSE-2019-1167)	Nessus	SuSE Local Security Checks	high
123551	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2019:0818-1)	Nessus	SuSE Local Security Checks	medium
123495	openSUSE Security Update : nodejs4 (openSUSE-2019-1076)	Nessus	SuSE Local Security Checks	medium
122999	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2019:0658-1)	Nessus	SuSE Local Security Checks	medium
122965	SUSE SLES12 Security Update : nodejs10 (SUSE-SU-2019:0636-1)	Nessus	SuSE Local Security Checks	high
122964	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2019:0635-1)	Nessus	SuSE Local Security Checks	high
122944	SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2019:0627-1)	Nessus	SuSE Local Security Checks	high
122571	FreeBSD : Node.js -- multiple vulnerabilities (b71d7193-3c54-11e9-a3f9-00155d006b02)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-5737

high

Tenable Plugins

high

medium

high

high

high

high

critical

high

high

high

medium

high

medium

medium

medium

high

high

high

medium