Red Hat Security Advisory

RHSA-2019:2258

http-parser security update

Released 2019-08-06 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) http-parser-2.7.1-8.el7
Red Hat Enterprise Linux Client Optional (v. 7) http-parser-devel-2.7.1-8.el7
Red Hat Enterprise Linux ComputeNode (v. 7) http-parser-2.7.1-8.el7
Red Hat Enterprise Linux ComputeNode Optional (v. 7) http-parser-devel-2.7.1-8.el7
Red Hat Enterprise Linux Server (v. 7) http-parser-2.7.1-8.el7, http-parser-2.7.1-8.el7.ppc
Red Hat Enterprise Linux Server Optional (v. 7) http-parser-devel-2.7.1-8.el7, http-parser-devel-2.7.1-8.el7.ppc
Red Hat Enterprise Linux Workstation (v. 7) http-parser-2.7.1-8.el7
Red Hat Enterprise Linux Workstation Optional (v. 7) http-parser-devel-2.7.1-8.el7

Fixes 2 records

TI-2018-08694 CVE-2018-12121 · GHSA-2p2c-vwq7-7vg6

Uncontrolled resource consumption in NodeJS Node.js

MEDIUM 51

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10207 Published 2018-11-28 Partial fix CWE-400

TI-2018-05184 CVE-2018-7159 · GHSA-87vg-5pwm-8x6w

Improper input validation in NodeJS Node.js

LOW 36

The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03542 Published 2018-05-17 Partial fix CWE-115