Amazon Linux AMI : http-parser (ALAS-2020-1359)

critical Nessus Plugin ID 135935

Language:

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

A flaw was found in the Node.js code where a specially crafted HTTP(s) request sent to a Node.js server failed to properly process the HTTP(s) headers, resulting in a request smuggling attack. An attacker can use this flaw to alter a request sent as an authenticated user if the Node.js server is deployed behind a proxy server that reuses connections. (CVE-2019-15605)

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer. (CVE-2018-12121)

It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior. (CVE-2018-7159)

Solution

Run 'yum update http-parser' to update your system.

Plugin Details

Severity: Critical

ID: 135935

File Name: ala_ALAS-2020-1359.nasl

Version: 1.3

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 4/24/2020

Updated: 3/14/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-15605

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:http-parser, cpe:/o:amazon:linux, p-cpe:/a:amazon:linux:http-parser-debuginfo, p-cpe:/a:amazon:linux:http-parser-devel

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/23/2020

Vulnerability Publication Date: 5/17/2018

Reference Information

CVE: CVE-2018-12121, CVE-2018-7159, CVE-2019-15605

ALAS: 2020-1359

Detections

Analytics