Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.

The remote host is affected by the vulnerability described in GLSA-202003-48 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly write arbitrary files, cause a Denial       of Service condition or can conduct HTTP request splitting attacks.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the remote Junos Space version is prior to 19.2R1. It is, therefore, affected by multiple vulnerabilities:
    - A memory double free vulnerability exists in The libcurl API function called `curl_maprintf()` before version 7.51.0       due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables. An unauthiticated remote attacker       can leverage this issue to perform unauthorized actions. This may aid in further attacks. (CVE-2016-8618) 

    - A denial of service (DoS) vulnerability exists in Node.js 6.16.0 and earlier due to that Keep-alive HTTP and HTTPS       connections can remain open and inactive for up to 2 minutes. An unauthenticated, remote attacker can exploit this       issue to cause a denial of service. (CVE-2016-8619)       
    - A vulnerability in curl before version 7.51.0 due to the use of an outdated IDNA 2003 standard to handle International       Domain Names. This could lead users to unknowingly issue network transfer requests to the wrong host. (CVE-2016-8625)

This update for nodejs6 to version 6.17.0 fixes the following issues :

Security issues fixed :

  - CVE-2019-5739: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127533).

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

  - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding     Oracle which under certain circumstances a TLS server     can be forced to respond differently to a client and     lead to the decryption of the data (bsc#1127080).

Release Notes: https://nodejs.org/en/blog/release/v6.17.0/ 

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs6 to version 6.17.0 fixes the following issues :

Security issues fixed :

CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533).

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).

Release Notes: https://nodejs.org/en/blog/release/v6.17.0/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 fixes the following issues :

Security issues fixed :

  - CVE-2019-5739: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127533).

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

  - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding     Oracle which under certain circumstances a TLS server     can be forced to respond differently to a client and     lead to the decryption of the data (bsc#1127080).&#9; 

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs4 fixes the following issues :

Security issues fixed :

CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533).

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Node.js reports :

Updates are now available for all active Node.js release lines. In addition to fixes for security flaws in Node.js, they also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2r which contains a fix for a moderate severity security vulnerability.

For these releases, we have decided to withhold the fix for the Misinterpretation of Input (CWE-115) flaw mentioned in the original announcement. This flaw is very low severity and we are not satisfied that we had a complete and stable fix ready for release. We will be seeking to address this flaw via alternate mechanisms in the near future. In addition, we have introduced an additional CVE for a change in Node.js 6 that we have decided to classify as a Denial of Service (CWE-400) flaw.

We recommend that all Node.js users upgrade to a version listed below as soon as possible. OpenSSL: 0-byte record padding oracle (CVE-2019-1559) OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only. Node.js 10 and 11 are not impacted by this vulnerability as they use newer versions of OpenSSL which do not contain the flaw.

Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid padding compared to a zero-byte record with an invalid MAC.
This can be used as the basis of a padding oracle attack to decrypt data.

Only TLS connections using certain ciphersuites executing under certain conditions are exploitable. We are currently unable to determine whether the use of OpenSSL in Node.js exposes this vulnerability. We are taking a cautionary approach and recommend the same for users. For more information, see the advisory and a detailed write-up by the reporters of the vulnerability.

ID	Name	Product	Family	Severity
134776	GLSA-202003-48 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
131701	Juniper Junos Space < 19.2R1 Multiple Vulnerabilities (JSA10951)	Nessus	Junos Local Security Checks	critical
123919	openSUSE Security Update : nodejs6 (openSUSE-2019-1173)	Nessus	SuSE Local Security Checks	medium
123551	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2019:0818-1)	Nessus	SuSE Local Security Checks	medium
123495	openSUSE Security Update : nodejs4 (openSUSE-2019-1076)	Nessus	SuSE Local Security Checks	medium
122999	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2019:0658-1)	Nessus	SuSE Local Security Checks	medium
122571	FreeBSD : Node.js -- multiple vulnerabilities (b71d7193-3c54-11e9-a3f9-00155d006b02)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-5739

high

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium