critique
CVE-2019-15605
nodejs: HTTP request smuggling using malformed Transfer-Encoding header
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD, Photon OS. Plus basse selon Red Hat (élevée), AlmaLinux (élevée), Amazon (élevée), Oracle (élevée), Rocky Linux (élevée), Ubuntu (moyenne).
Description
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | nodejs10 | 10.19.0-1.ph1 |
| Photon OS 3.0 | nodejs | 13.8.0-1.ph3 |
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging | 1.18.3-1.module_el8.3.0+2023+d2377ea3 et 1 autres |
| alpine 3.10 | nodejs | 10.19.0-r0 |
| alpine 3.11 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs, nodejs-current | 12.15.0-r0 et 1 autres |
| alpine 3.13 | nodejs, nodejs-current | 12.15.0-r0 et 1 autres |
| alpine 3.14 | nodejs, nodejs-current | 12.15.0-r0 et 1 autres |
| alpine 3.15 | nodejs, nodejs-current | 12.15.0-r0 et 1 autres |
| alpine 3.16 | nodejs, nodejs-current | 12.15.0-r0 et 1 autres |
| alpine 3.17 | nodejs, nodejs-current | 12.15.0-r0 et 1 autres |
| alpine 3.18 | nodejs, nodejs-current | 12.15.0-r0 et 1 autres |
Afficher les 71 entrées de 36 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | nodejs10 | 10.19.0-1.ph1 |
| Photon OS 3.0 | nodejs | 13.8.0-1.ph3 |
| alma 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alpine 3.10 | nodejs | 10.19.0-r0 |
| alpine 3.11 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs | 12.15.0-r0 |
| alpine 3.12 | nodejs-current | 13.11.0-r0 |
| alpine 3.13 | nodejs | 12.15.0-r0 |
| alpine 3.13 | nodejs-current | 13.11.0-r0 |
| alpine 3.14 | nodejs | 12.15.0-r0 |
| alpine 3.14 | nodejs-current | 13.11.0-r0 |
| alpine 3.15 | nodejs | 12.15.0-r0 |
| alpine 3.15 | nodejs-current | 13.11.0-r0 |
| alpine 3.16 | nodejs | 12.15.0-r0 |
| alpine 3.16 | nodejs-current | 13.11.0-r0 |
| alpine 3.17 | nodejs | 12.15.0-r0 |
| alpine 3.17 | nodejs-current | 13.11.0-r0 |
| alpine 3.18 | nodejs | 12.15.0-r0 |
| alpine 3.18 | nodejs-current | 13.11.0-r0 |
| alpine 3.19 | nodejs | 12.15.0-r0 |
| alpine 3.19 | nodejs-current | 13.11.0-r0 |
| alpine 3.20 | nodejs | 12.15.0-r0 |
| alpine 3.20 | nodejs-current | 13.11.0-r0 |
| alpine 3.21 | nodejs | 12.15.0-r0 |
| alpine 3.21 | nodejs-current | 13.11.0-r0 |
| alpine 3.22 | nodejs | 12.15.0-r0 |
| alpine 3.22 | nodejs-current | 13.11.0-r0 |
| alpine 3.23 | nodejs | 12.15.0-r0 |
| alpine 3.23 | nodejs-current | 13.11.0-r0 |
| alpine 3.24 | nodejs | 12.15.0-r0 |
| alpine 3.24 | nodejs-current | 13.11.0-r0 |
| alpine 3.9 | nodejs | 10.19.0-r0 |
| alpine edge | nodejs | 12.15.0-r0 |
| alpine edge | nodejs-current | 13.11.0-r0 |
| amazon linux 1 | http-parser | 2.9.3-1.2.amzn1 |
| amazon linux 1 | http-parser-debuginfo | 2.9.3-1.2.amzn1 |
| amazon linux 1 | http-parser-devel | 2.9.3-1.2.amzn1 |
| amazon linux 2 | http-parser | 2.7.1-8.amzn2.2 |
| amazon linux 2 | http-parser-debuginfo | 2.7.1-8.amzn2.2 |
| amazon linux 2 | http-parser-devel | 2.7.1-8.amzn2.2 |
| debian 10 | http-parser | 2.8.1-1+deb10u1 |
| debian 10 | nodejs | 10.19.0~dfsg1-1 |
| debian 11 | http-parser | 2.9.4-2 |
| debian 11 | nodejs | 10.19.0~dfsg-1 |
| debian 12 | http-parser | 2.9.4-2 |
| debian 12 | nodejs | 10.19.0~dfsg-1 |
| debian 13 | http-parser | 2.9.4-2 |
| debian 13 | nodejs | 10.19.0~dfsg-1 |
| debian 14 | http-parser | 2.9.4-2 |
| debian 14 | nodejs | 10.19.0~dfsg-1 |
| debian 8 | http-parser | pas de correctif indiqué |
| debian 8 | nodejs | pas de correctif indiqué |
| debian 9 | http-parser | pas de correctif indiqué |
| debian 9 | nodejs | pas de correctif indiqué |
| echo | http-parser | 2.9.4-2 |
| echo | nodejs | 10.19.0~dfsg-1 |
| Oracle Linux 7 | http-parser | 2.7.1-8.el7_7.2 |
| Oracle Linux 7 | http-parser-devel | 2.7.1-8.el7_7.2 |
| Oracle Linux 8 | http-parser | 2.8.0-5.el8_1.2 |
| Oracle Linux 8 | nodejs | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-devel | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-docs | 1:12.16.1-1.module+el8.1.0+5548+c572d87b |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux 8 | npm | 1:6.13.4-1.12.16.1.1.module+el8.1.0+5548+c572d87b |
| rocky 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:10::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| root.io debian 12 | rootio-nodejs | 10.19.0~dfsg-1 |
| ubuntu 16.04-ESM | nodejs | 4.2.6~dfsg-1ubuntu4.2+esm2 |
| ubuntu 18.04-ESM | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm2 |
Références
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html
- https://access.redhat.com/errata/RHSA-2020:0573
- https://access.redhat.com/errata/RHSA-2020:0579
- https://access.redhat.com/errata/RHSA-2020:0597
- https://access.redhat.com/errata/RHSA-2020:0598
- https://access.redhat.com/errata/RHSA-2020:0602
- https://access.redhat.com/errata/RHSA-2020:0703
- https://access.redhat.com/errata/RHSA-2020:0707
Les 35 références
- https://access.redhat.com/errata/RHSA-2020:0708
- https://access.redhat.com/security/cve/CVE-2019-15605
- https://bugzilla.redhat.com/show_bug.cgi?id=1800364
- https://bugzilla.redhat.com/show_bug.cgi?id=1800366
- https://bugzilla.redhat.com/show_bug.cgi?id=1800367
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15604
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15605
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15606
- https://errata.almalinux.org/8/ALSA-2020-0598.html
- https://errata.rockylinux.org/RLSA-2020:0598
- https://hackerone.com/reports/735748
- https://linux.oracle.com/cve/CVE-2019-15605.html
- https://linux.oracle.com/errata/ELSA-2020-0708.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/
- https://nodejs.org/en/blog/release/v10.19.0/
- https://nodejs.org/en/blog/release/v12.15.0/
- https://nodejs.org/en/blog/release/v13.8.0/
- https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2019-15605
- https://security.gentoo.org/glsa/202003-48
- https://security.netapp.com/advisory/ntap-20200221-0004/
- https://ubuntu.com/security/notices/USN-6380-1
- https://www.cve.org/CVERecord?id=CVE-2019-15605
- https://www.debian.org/security/2020/dsa-4669
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html