Red Hat Security AdvisoryRHSA-2019:2925
nodejs:10 security update
Released 2019-09-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.aarch64::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.s390x::nodejs:10 +15
Fixes 9 records
Priority HIGH 75
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.87286 · Published 2019-08-13 · Partial fix CWE-400
Priority HIGH 74
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.82813 · Published 2019-08-13 · Partial fix · 0.0.0-20190813141303-74dc4d7220e7 CWE-400
Priority HIGH 74
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.83433 · Published 2019-08-13 · Partial fix · 0.0.0-20190813141303-74dc4d7220e7 CWE-400
Priority HIGH 73
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.81556 · Published 2019-08-13 · Partial fix CWE-400
Priority HIGH 67
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.59547 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 62
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.57461 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 55
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.27004 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 54
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.25448 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 49
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.16184 · Published 2019-03-28 · Partial fix · 6.17.0, 8.15.1 +2 CWE-400
THREATIST.IORead the docs