kritisch
CVE-2019-15605
nodejs: HTTP request smuggling using malformed Transfer-Encoding header
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Photon OS. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Amazon (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (mittel).
Beschreibung
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | nodejs10 | 10.19.0-1.ph1 |
| Photon OS 3.0 | nodejs | 13.8.0-1.ph3 |
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging | 1.18.3-1.module_el8.3.0+2023+d2377ea3 und 1 weitere |
| alpine 3.10 | nodejs | 10.19.0-r0 |
| alpine 3.11 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs, nodejs-current | 12.15.0-r0 und 1 weitere |
| alpine 3.13 | nodejs, nodejs-current | 12.15.0-r0 und 1 weitere |
| alpine 3.14 | nodejs, nodejs-current | 12.15.0-r0 und 1 weitere |
| alpine 3.15 | nodejs, nodejs-current | 12.15.0-r0 und 1 weitere |
| alpine 3.16 | nodejs, nodejs-current | 12.15.0-r0 und 1 weitere |
| alpine 3.17 | nodejs, nodejs-current | 12.15.0-r0 und 1 weitere |
| alpine 3.18 | nodejs, nodejs-current | 12.15.0-r0 und 1 weitere |
Alle 71 Einträge aus 36 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | nodejs10 | 10.19.0-1.ph1 |
| Photon OS 3.0 | nodejs | 13.8.0-1.ph3 |
| alma 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alpine 3.10 | nodejs | 10.19.0-r0 |
| alpine 3.11 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs-current | 13.11.0-r0 |
| alpine 3.13 | nodejs | 12.15.0-r0 |
| alpine 3.13 | nodejs-current | 13.11.0-r0 |
| alpine 3.14 | nodejs | 12.15.0-r0 |
| alpine 3.14 | nodejs-current | 13.11.0-r0 |
| alpine 3.15 | nodejs | 12.15.0-r0 |
| alpine 3.15 | nodejs-current | 13.11.0-r0 |
| alpine 3.16 | nodejs | 12.15.0-r0 |
| alpine 3.16 | nodejs-current | 13.11.0-r0 |
| alpine 3.17 | nodejs | 12.15.0-r0 |
| alpine 3.17 | nodejs-current | 13.11.0-r0 |
| alpine 3.18 | nodejs | 12.15.0-r0 |
| alpine 3.18 | nodejs-current | 13.11.0-r0 |
| alpine 3.19 | nodejs | 12.15.0-r0 |
| alpine 3.19 | nodejs-current | 13.11.0-r0 |
| alpine 3.20 | nodejs | 12.15.0-r0 |
| alpine 3.20 | nodejs-current | 13.11.0-r0 |
| alpine 3.21 | nodejs | 12.15.0-r0 |
| alpine 3.21 | nodejs-current | 13.11.0-r0 |
| alpine 3.22 | nodejs | 12.15.0-r0 |
| alpine 3.22 | nodejs-current | 13.11.0-r0 |
| alpine 3.23 | nodejs | 12.15.0-r0 |
| alpine 3.23 | nodejs-current | 13.11.0-r0 |
| alpine 3.24 | nodejs | 12.15.0-r0 |
| alpine 3.24 | nodejs-current | 13.11.0-r0 |
| alpine 3.9 | nodejs | 10.19.0-r0 |
| alpine edge | nodejs | 12.15.0-r0 |
| alpine edge | nodejs-current | 13.11.0-r0 |
| amazon linux 1 | http-parser | 2.9.3-1.2.amzn1 |
| amazon linux 1 | http-parser-debuginfo | 2.9.3-1.2.amzn1 |
| amazon linux 1 | http-parser-devel | 2.9.3-1.2.amzn1 |
| amazon linux 2 | http-parser | 2.7.1-8.amzn2.2 |
| amazon linux 2 | http-parser-debuginfo | 2.7.1-8.amzn2.2 |
| amazon linux 2 | http-parser-devel | 2.7.1-8.amzn2.2 |
| debian 10 | http-parser | 2.8.1-1+deb10u1 |
| debian 10 | nodejs | 10.19.0~dfsg1-1 |
| debian 11 | http-parser | 2.9.4-2 |
| debian 11 | nodejs | 10.19.0~dfsg-1 |
| debian 12 | http-parser | 2.9.4-2 |
| debian 12 | nodejs | 10.19.0~dfsg-1 |
| debian 13 | http-parser | 2.9.4-2 |
| debian 13 | nodejs | 10.19.0~dfsg-1 |
| debian 14 | http-parser | 2.9.4-2 |
| debian 14 | nodejs | 10.19.0~dfsg-1 |
| debian 8 | http-parser | kein Fix angegeben |
| debian 8 | nodejs | kein Fix angegeben |
| debian 9 | http-parser | kein Fix angegeben |
| debian 9 | nodejs | kein Fix angegeben |
| echo | http-parser | 2.9.4-2 |
| echo | nodejs | 10.19.0~dfsg-1 |
| Oracle Linux 7 | http-parser | 2.7.1-8.el7_7.2 |
| Oracle Linux 7 | http-parser-devel | 2.7.1-8.el7_7.2 |
| Oracle Linux 8 | http-parser | 2.8.0-5.el8_1.2 |
| Oracle Linux 8 | nodejs | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-devel | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-docs | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux 8 | npm | 1:6.13.4-1.12.16.1.1.module+el8.1.0+5548+c572d87b |
| rocky 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:10::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| root.io debian 12 | rootio-nodejs | 10.19.0~dfsg-1 |
| ubuntu 16.04-ESM | nodejs | 4.2.6~dfsg-1ubuntu4.2+esm2 |
| ubuntu 18.04-ESM | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm2 |
Referenzen
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html
- https://access.redhat.com/errata/RHSA-2020:0573
- https://access.redhat.com/errata/RHSA-2020:0579
- https://access.redhat.com/errata/RHSA-2020:0597
- https://access.redhat.com/errata/RHSA-2020:0598
- https://access.redhat.com/errata/RHSA-2020:0602
- https://access.redhat.com/errata/RHSA-2020:0703
- https://access.redhat.com/errata/RHSA-2020:0707
Alle 35 Referenzen
- https://access.redhat.com/errata/RHSA-2020:0708
- https://access.redhat.com/security/cve/CVE-2019-15605
- https://bugzilla.redhat.com/show_bug.cgi?id=1800364
- https://bugzilla.redhat.com/show_bug.cgi?id=1800366
- https://bugzilla.redhat.com/show_bug.cgi?id=1800367
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15604
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15605
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15606
- https://errata.almalinux.org/8/ALSA-2020-0598.html
- https://errata.rockylinux.org/RLSA-2020:0598
- https://hackerone.com/reports/735748
- https://linux.oracle.com/cve/CVE-2019-15605.html
- https://linux.oracle.com/errata/ELSA-2020-0708.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/
- https://nodejs.org/en/blog/release/v10.19.0/
- https://nodejs.org/en/blog/release/v12.15.0/
- https://nodejs.org/en/blog/release/v13.8.0/
- https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2019-15605
- https://security.gentoo.org/glsa/202003-48
- https://security.netapp.com/advisory/ntap-20200221-0004/
- https://ubuntu.com/security/notices/USN-6380-1
- https://www.cve.org/CVERecord?id=CVE-2019-15605
- https://www.debian.org/security/2020/dsa-4669
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html