crítica
CVE-2019-15605
nodejs: HTTP request smuggling using malformed Transfer-Encoding header
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | nodejs10 | 10.19.0-1.ph1 |
| Photon OS 3.0 | nodejs | 13.8.0-1.ph3 |
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging | 1.18.3-1.module_el8.3.0+2023+d2377ea3 y 1 más |
| alpine 3.10 | nodejs | 10.19.0-r0 |
| alpine 3.11 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.13 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.14 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.15 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.16 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.17 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.18 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
Mostrar las 71 entradas de 36 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | nodejs10 | 10.19.0-1.ph1 |
| Photon OS 3.0 | nodejs | 13.8.0-1.ph3 |
| alma 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alpine 3.10 | nodejs | 10.19.0-r0 |
| alpine 3.11 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs-current | 13.11.0-r0 |
| alpine 3.13 | nodejs | 12.15.0-r0 |
| alpine 3.13 | nodejs-current | 13.11.0-r0 |
| alpine 3.14 | nodejs | 12.15.0-r0 |
| alpine 3.14 | nodejs-current | 13.11.0-r0 |
| alpine 3.15 | nodejs | 12.15.0-r0 |
| alpine 3.15 | nodejs-current | 13.11.0-r0 |
| alpine 3.16 | nodejs | 12.15.0-r0 |
| alpine 3.16 | nodejs-current | 13.11.0-r0 |
| alpine 3.17 | nodejs | 12.15.0-r0 |
| alpine 3.17 | nodejs-current | 13.11.0-r0 |
| alpine 3.18 | nodejs | 12.15.0-r0 |
| alpine 3.18 | nodejs-current | 13.11.0-r0 |
| alpine 3.19 | nodejs | 12.15.0-r0 |
| alpine 3.19 | nodejs-current | 13.11.0-r0 |
| alpine 3.20 | nodejs | 12.15.0-r0 |
| alpine 3.20 | nodejs-current | 13.11.0-r0 |
| alpine 3.21 | nodejs | 12.15.0-r0 |
| alpine 3.21 | nodejs-current | 13.11.0-r0 |
| alpine 3.22 | nodejs | 12.15.0-r0 |
| alpine 3.22 | nodejs-current | 13.11.0-r0 |
| alpine 3.23 | nodejs | 12.15.0-r0 |
| alpine 3.23 | nodejs-current | 13.11.0-r0 |
| alpine 3.24 | nodejs | 12.15.0-r0 |
| alpine 3.24 | nodejs-current | 13.11.0-r0 |
| alpine 3.9 | nodejs | 10.19.0-r0 |
| alpine edge | nodejs | 12.15.0-r0 |
| alpine edge | nodejs-current | 13.11.0-r0 |
| amazon linux 1 | http-parser | 2.9.3-1.2.amzn1 |
| amazon linux 1 | http-parser-debuginfo | 2.9.3-1.2.amzn1 |
| amazon linux 1 | http-parser-devel | 2.9.3-1.2.amzn1 |
| amazon linux 2 | http-parser | 2.7.1-8.amzn2.2 |
| amazon linux 2 | http-parser-debuginfo | 2.7.1-8.amzn2.2 |
| amazon linux 2 | http-parser-devel | 2.7.1-8.amzn2.2 |
| debian 10 | http-parser | 2.8.1-1+deb10u1 |
| debian 10 | nodejs | 10.19.0~dfsg1-1 |
| debian 11 | http-parser | 2.9.4-2 |
| debian 11 | nodejs | 10.19.0~dfsg-1 |
| debian 12 | http-parser | 2.9.4-2 |
| debian 12 | nodejs | 10.19.0~dfsg-1 |
| debian 13 | http-parser | 2.9.4-2 |
| debian 13 | nodejs | 10.19.0~dfsg-1 |
| debian 14 | http-parser | 2.9.4-2 |
| debian 14 | nodejs | 10.19.0~dfsg-1 |
| debian 8 | http-parser | sin corrección indicada |
| debian 8 | nodejs | sin corrección indicada |
| debian 9 | http-parser | sin corrección indicada |
| debian 9 | nodejs | sin corrección indicada |
| echo | http-parser | 2.9.4-2 |
| echo | nodejs | 10.19.0~dfsg-1 |
| Oracle Linux 7 | http-parser | 2.7.1-8.el7_7.2 |
| Oracle Linux 7 | http-parser-devel | 2.7.1-8.el7_7.2 |
| Oracle Linux 8 | http-parser | 2.8.0-5.el8_1.2 |
| Oracle Linux 8 | nodejs | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-devel | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-docs | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux 8 | npm | 1:6.13.4-1.12.16.1.1.module+el8.1.0+5548+c572d87b |
| rocky 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:10::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| root.io debian 12 | rootio-nodejs | 10.19.0~dfsg-1 |
| ubuntu 16.04-ESM | nodejs | 4.2.6~dfsg-1ubuntu4.2+esm2 |
| ubuntu 18.04-ESM | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm2 |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html
- https://access.redhat.com/errata/RHSA-2020:0573
- https://access.redhat.com/errata/RHSA-2020:0579
- https://access.redhat.com/errata/RHSA-2020:0597
- https://access.redhat.com/errata/RHSA-2020:0598
- https://access.redhat.com/errata/RHSA-2020:0602
- https://access.redhat.com/errata/RHSA-2020:0703
- https://access.redhat.com/errata/RHSA-2020:0707
Las 35 referencias
- https://access.redhat.com/errata/RHSA-2020:0708
- https://access.redhat.com/security/cve/CVE-2019-15605
- https://bugzilla.redhat.com/show_bug.cgi?id=1800364
- https://bugzilla.redhat.com/show_bug.cgi?id=1800366
- https://bugzilla.redhat.com/show_bug.cgi?id=1800367
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15604
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15605
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15606
- https://errata.almalinux.org/8/ALSA-2020-0598.html
- https://errata.rockylinux.org/RLSA-2020:0598
- https://hackerone.com/reports/735748
- https://linux.oracle.com/cve/CVE-2019-15605.html
- https://linux.oracle.com/errata/ELSA-2020-0708.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/
- https://nodejs.org/en/blog/release/v10.19.0/
- https://nodejs.org/en/blog/release/v12.15.0/
- https://nodejs.org/en/blog/release/v13.8.0/
- https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2019-15605
- https://security.gentoo.org/glsa/202003-48
- https://security.netapp.com/advisory/ntap-20200221-0004/
- https://ubuntu.com/security/notices/USN-6380-1
- https://www.cve.org/CVERecord?id=CVE-2019-15605
- https://www.debian.org/security/2020/dsa-4669
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html