Уязвимость CVE-2019-15605: Информация

Описание

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Важность: CRITICAL (9,8) Вектор: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-15605
Опубликовано: 7 февраля 2020 г.
Изменено: 8 марта 2024 г.
Идентификатор типа ошибки: CWE-444

Исправленные пакеты

Имя пакета
Ветка
Исправлено в версии
Версия в репозитории
Errata ID
№ Задания
Состояние
nodesisyphus13.8.0-alt120.12.2-alt1ALT-PU-2020-1195-1245867Исправлено
nodep1013.8.0-alt116.19.1-alt1ALT-PU-2020-1195-1245867Исправлено
nodep914.3.0-alt114.17.2-alt1ALT-PU-2020-2195-1247371Исправлено
nodec10f113.8.0-alt116.19.1-alt1ALT-PU-2020-1195-1245867Исправлено
nodec9f214.3.0-alt116.19.1-alt0.c9.1ALT-PU-2020-2195-1247371Исправлено

Ссылки на рекомендации, решения и инструменты

Ссылка
Ресурс
https://nodejs.org/en/blog/release/v13.8.0/
  • Vendor Advisory
https://hackerone.com/reports/735748
  • Permissions Required
  • Third Party Advisory
https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/
  • Vendor Advisory
https://nodejs.org/en/blog/release/v10.19.0/
  • Release Notes
  • Vendor Advisory
https://nodejs.org/en/blog/release/v12.15.0/
  • Release Notes
  • Vendor Advisory
RHSA-2020:0573
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20200221-0004/
  • Third Party Advisory
RHSA-2020:0579
  • Third Party Advisory
RHSA-2020:0598
  • Third Party Advisory
RHSA-2020:0597
  • Third Party Advisory
RHSA-2020:0602
  • Third Party Advisory
openSUSE-SU-2020:0293
  • Mailing List
  • Third Party Advisory
RHSA-2020:0703
  • Third Party Advisory
RHSA-2020:0707
  • Third Party Advisory
RHSA-2020:0708
  • Third Party Advisory
GLSA-202003-48
  • Third Party Advisory
N/A
  • Patch
  • Third Party Advisory
DSA-4669
  • Third Party Advisory
N/A
  • Patch
  • Third Party Advisory
FEDORA-2020-3838c8ea98
    FEDORA-2020-47efc31973

        1. Конфигурация 1

          cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
          Start including
          12.0.0
          End excliding
          12.15.0
          cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
          Start including
          10.0.0
          End excliding
          10.19.0
          cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
          Start including
          13.0.0
          End excliding
          13.8.0

          Конфигурация 2

          cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

          Конфигурация 3

          cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

          Конфигурация 4

          cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

          Конфигурация 5

          cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
          cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*

          Конфигурация 6

          cpe:2.3:a:oracle:graalvm:20.0.0:*:*:*:enterprise:*:*:*
          cpe:2.3:a:oracle:graalvm:19.3.1:*:*:*:enterprise:*:*:*
      VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
      Версия: v24.5.0
      Наверх