crítica
CVE-2019-15606
nodejs: HTTP header values do not have trailing optional whitespace trimmed
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según AlmaLinux (alta), Oracle (alta), Rocky Linux (alta), Red Hat (media), Ubuntu (media).
Descripción
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | nodejs10 | 10.19.0-1.ph1 |
| Photon OS 3.0 | nodejs | 13.8.0-1.ph3 |
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging | 1.18.3-1.module_el8.3.0+2023+d2377ea3 y 1 más |
| alpine 3.10 | nodejs | 10.19.0-r0 |
| alpine 3.11 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.13 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.14 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.15 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.16 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.17 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
| alpine 3.18 | nodejs, nodejs-current | 12.15.0-r0 y 1 más |
Mostrar las 54 entradas de 33 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | nodejs10 | 10.19.0-1.ph1 |
| Photon OS 3.0 | nodejs | 13.8.0-1.ph3 |
| alma 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alpine 3.10 | nodejs | 10.19.0-r0 |
| alpine 3.11 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs-current | 13.11.0-r0 |
| alpine 3.13 | nodejs | 12.15.0-r0 |
| alpine 3.13 | nodejs-current | 13.11.0-r0 |
| alpine 3.14 | nodejs | 12.15.0-r0 |
| alpine 3.14 | nodejs-current | 13.11.0-r0 |
| alpine 3.15 | nodejs | 12.15.0-r0 |
| alpine 3.15 | nodejs-current | 13.11.0-r0 |
| alpine 3.16 | nodejs | 12.15.0-r0 |
| alpine 3.16 | nodejs-current | 13.11.0-r0 |
| alpine 3.17 | nodejs | 12.15.0-r0 |
| alpine 3.17 | nodejs-current | 13.11.0-r0 |
| alpine 3.18 | nodejs | 12.15.0-r0 |
| alpine 3.18 | nodejs-current | 13.11.0-r0 |
| alpine 3.19 | nodejs | 12.15.0-r0 |
| alpine 3.19 | nodejs-current | 13.11.0-r0 |
| alpine 3.20 | nodejs | 12.15.0-r0 |
| alpine 3.20 | nodejs-current | 13.11.0-r0 |
| alpine 3.21 | nodejs | 12.15.0-r0 |
| alpine 3.21 | nodejs-current | 13.11.0-r0 |
| alpine 3.22 | nodejs | 12.15.0-r0 |
| alpine 3.22 | nodejs-current | 13.11.0-r0 |
| alpine 3.23 | nodejs | 12.15.0-r0 |
| alpine 3.23 | nodejs-current | 13.11.0-r0 |
| alpine 3.24 | nodejs | 12.15.0-r0 |
| alpine 3.24 | nodejs-current | 13.11.0-r0 |
| alpine 3.9 | nodejs | 10.19.0-r0 |
| alpine edge | nodejs | 12.15.0-r0 |
| alpine edge | nodejs-current | 13.11.0-r0 |
| debian 10 | nodejs | 10.19.0~dfsg1-1 |
| debian 11 | nodejs | 10.19.0~dfsg-1 |
| debian 12 | nodejs | 10.19.0~dfsg-1 |
| debian 13 | nodejs | 10.19.0~dfsg-1 |
| debian 14 | nodejs | 10.19.0~dfsg-1 |
| debian 8 | nodejs | sin corrección indicada |
| debian 9 | nodejs | sin corrección indicada |
| echo | nodejs | 10.19.0~dfsg-1 |
| Oracle Linux 8 | nodejs | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-devel | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-docs | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux 8 | npm | 1:6.13.4-1.12.16.1.1.module+el8.1.0+5548+c572d87b |
| rocky 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:10::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| root.io debian 12 | rootio-nodejs | 10.19.0~dfsg-1 |
| ubuntu 16.04-ESM | nodejs | 4.2.6~dfsg-1ubuntu4.2+esm2 |
| ubuntu 18.04-ESM | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm2 |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html
- https://access.redhat.com/errata/RHSA-2020:0573
- https://access.redhat.com/errata/RHSA-2020:0579
- https://access.redhat.com/errata/RHSA-2020:0597
- https://access.redhat.com/errata/RHSA-2020:0598
- https://access.redhat.com/errata/RHSA-2020:0602
- https://access.redhat.com/security/cve/CVE-2019-15606
- https://bugzilla.redhat.com/show_bug.cgi?id=1800364
Las 30 referencias
- https://bugzilla.redhat.com/show_bug.cgi?id=1800366
- https://bugzilla.redhat.com/show_bug.cgi?id=1800367
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15604
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15605
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15606
- https://errata.almalinux.org/8/ALSA-2020-0598.html
- https://errata.rockylinux.org/RLSA-2020:0598
- https://hackerone.com/reports/730779
- https://linux.oracle.com/cve/CVE-2019-15606.html
- https://linux.oracle.com/errata/ELSA-2020-0598.html
- https://nodejs.org/en/blog/release/v10.19.0/
- https://nodejs.org/en/blog/release/v12.15.0/
- https://nodejs.org/en/blog/release/v13.8.0/
- https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2019-15606
- https://security.gentoo.org/glsa/202003-48
- https://security.netapp.com/advisory/ntap-20200221-0004/
- https://ubuntu.com/security/notices/USN-6380-1
- https://www.cve.org/CVERecord?id=CVE-2019-15606
- https://www.debian.org/security/2020/dsa-4669
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html