Issued:
2019-09-30
Updated:
2019-09-30

RHSA-2019:2925 - Security Advisory

Synopsis

Important: nodejs:10 security update

Type/Severity

Security Advisory: Important

Topic

An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.16.3).

Security Fix(es):

  • HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)
  • HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)
  • HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)
  • HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)
  • HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)
  • HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)
  • HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
  • HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1735645 - CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth
  • BZ - 1735741 - CVE-2019-9513 HTTP/2: flood using PRIORITY frames results in excessive resource consumption
  • BZ - 1735744 - CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth
  • BZ - 1735745 - CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth
  • BZ - 1735749 - CVE-2019-9518 HTTP/2: flood using empty frames results in excessive resource consumption
  • BZ - 1741860 - CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service
  • BZ - 1741864 - CVE-2019-9516 HTTP/2: 0-length headers lead to denial of service
  • BZ - 1741868 - CVE-2019-9517 HTTP/2: request for large response leads to denial of service

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
nodejs-10.16.3-2.module+el8.0.0+4214+49953fda.src.rpm SHA-256: 52b3be823cbe47aaa241dc3eac74bca867f6c0d70eb9a7c59ad518b90899f8f7
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.src.rpm SHA-256: fd478f2549e3bbf506de232a248b8fc61f0092d9fe186599745b0785cfc7e0c2
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.src.rpm SHA-256: 01c71dee45a43aeedaa345bfcb877f73db8e5c0af0c606d1f2a2745c3e353f73
x86_64
nodejs-10.16.3-2.module+el8.0.0+4214+49953fda.x86_64.rpm SHA-256: ad14b1a856d8825e068bbbd65cd86bc692d4358451ccb27089cf019d0f5a1e1a
nodejs-debuginfo-10.16.3-2.module+el8.0.0+4214+49953fda.x86_64.rpm SHA-256: e0b7f0519f6df496ee96101bb6c319a01cae711bce2ca435d1190a42c09c4542
nodejs-debugsource-10.16.3-2.module+el8.0.0+4214+49953fda.x86_64.rpm SHA-256: 04ae8a7861a9e2bc3edc5376122703cc1c4a9b0c9e73be286c450ebbe215d9c7
nodejs-devel-10.16.3-2.module+el8.0.0+4214+49953fda.x86_64.rpm SHA-256: 5502d59e4f5c6e78e26d1d4987b9c11ac86c9c3612337f4caba7bb507bc942b1
nodejs-devel-debuginfo-10.16.3-2.module+el8.0.0+4214+49953fda.x86_64.rpm SHA-256: 8aa414756587c6a37cba71808f4427794cc56c5e2b22263cbca93eb8a57f654c
nodejs-docs-10.16.3-2.module+el8.0.0+4214+49953fda.noarch.rpm SHA-256: ff5d9e6e8359c6126088012a14ae25b0e5b6a74da33d0d8470a4c63805a013b1
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpm SHA-256: 403e2a69dac714c9c946b51af2cbcd1e25bc88c8e762236725d95c457d75d48f
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpm SHA-256: 1e250d01555333a28809fb735793ce8a44b6b88ced07e80024722bd423ad6cda
npm-6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda.x86_64.rpm SHA-256: febbad66f43ccb7664b1d21c3a3aad7f98920088a1673b46ba7b30dbf7a5f188

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
nodejs-10.16.3-2.module+el8.0.0+4214+49953fda.src.rpm SHA-256: 52b3be823cbe47aaa241dc3eac74bca867f6c0d70eb9a7c59ad518b90899f8f7
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.src.rpm SHA-256: fd478f2549e3bbf506de232a248b8fc61f0092d9fe186599745b0785cfc7e0c2
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.src.rpm SHA-256: 01c71dee45a43aeedaa345bfcb877f73db8e5c0af0c606d1f2a2745c3e353f73
s390x
nodejs-docs-10.16.3-2.module+el8.0.0+4214+49953fda.noarch.rpm SHA-256: ff5d9e6e8359c6126088012a14ae25b0e5b6a74da33d0d8470a4c63805a013b1
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpm SHA-256: 403e2a69dac714c9c946b51af2cbcd1e25bc88c8e762236725d95c457d75d48f
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpm SHA-256: 1e250d01555333a28809fb735793ce8a44b6b88ced07e80024722bd423ad6cda
nodejs-10.16.3-2.module+el8.0.0+4214+49953fda.s390x.rpm SHA-256: f17c228a49b4786e3fccbf2d187864ff2b6dea35677b951b4fb949e2770f4150
nodejs-debuginfo-10.16.3-2.module+el8.0.0+4214+49953fda.s390x.rpm SHA-256: 6d616e2fd042fdc9bf7f017bf5298d53acdb50bd4cf56288853928530ce43288
nodejs-debugsource-10.16.3-2.module+el8.0.0+4214+49953fda.s390x.rpm SHA-256: 0d823caf92a6247635c93994cc1c1a6ab1450b09a414e604aea7321fefb4fc5a
nodejs-devel-10.16.3-2.module+el8.0.0+4214+49953fda.s390x.rpm SHA-256: 4e761f51a9858d4d31e46586925b8a3ef00f73edfe631547c619bd457d959773
npm-6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda.s390x.rpm SHA-256: daf394f5f5d3f92f2ae27f1446b85a146c1758bf696e22eba7521f95754a1cd8

Red Hat Enterprise Linux for Power, little endian 8

SRPM
nodejs-10.16.3-2.module+el8.0.0+4214+49953fda.src.rpm SHA-256: 52b3be823cbe47aaa241dc3eac74bca867f6c0d70eb9a7c59ad518b90899f8f7
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.src.rpm SHA-256: fd478f2549e3bbf506de232a248b8fc61f0092d9fe186599745b0785cfc7e0c2
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.src.rpm SHA-256: 01c71dee45a43aeedaa345bfcb877f73db8e5c0af0c606d1f2a2745c3e353f73
ppc64le
nodejs-docs-10.16.3-2.module+el8.0.0+4214+49953fda.noarch.rpm SHA-256: ff5d9e6e8359c6126088012a14ae25b0e5b6a74da33d0d8470a4c63805a013b1
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpm SHA-256: 403e2a69dac714c9c946b51af2cbcd1e25bc88c8e762236725d95c457d75d48f
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpm SHA-256: 1e250d01555333a28809fb735793ce8a44b6b88ced07e80024722bd423ad6cda
nodejs-10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le.rpm SHA-256: da25ac48e0bfd04f6441200fd77da4bf5dcb903a2b0885c823917ce99d60b860
nodejs-debuginfo-10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le.rpm SHA-256: 8b1bc08d185060522df6f389eddbcf7b457d30c1a591bfbf6f77be3e7a9d09df
nodejs-debugsource-10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le.rpm SHA-256: a1d607d713a8a7fd9363a68bf777013c1cfbffb744c6f06f71bd3bc87eb03de9
nodejs-devel-10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le.rpm SHA-256: e111f1d63dbbf84feeff7fc784b7e2c430311f96ee1b3bb492442dbcda4d9943
npm-6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda.ppc64le.rpm SHA-256: d007e35bd7b1ae53deab6cb2cac9d46abda3e119d28e9c0b1d4ab561f7fc9e97

Red Hat Enterprise Linux for ARM 64 8

SRPM
nodejs-10.16.3-2.module+el8.0.0+4214+49953fda.src.rpm SHA-256: 52b3be823cbe47aaa241dc3eac74bca867f6c0d70eb9a7c59ad518b90899f8f7
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.src.rpm SHA-256: fd478f2549e3bbf506de232a248b8fc61f0092d9fe186599745b0785cfc7e0c2
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.src.rpm SHA-256: 01c71dee45a43aeedaa345bfcb877f73db8e5c0af0c606d1f2a2745c3e353f73
aarch64
nodejs-docs-10.16.3-2.module+el8.0.0+4214+49953fda.noarch.rpm SHA-256: ff5d9e6e8359c6126088012a14ae25b0e5b6a74da33d0d8470a4c63805a013b1
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpm SHA-256: 403e2a69dac714c9c946b51af2cbcd1e25bc88c8e762236725d95c457d75d48f
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpm SHA-256: 1e250d01555333a28809fb735793ce8a44b6b88ced07e80024722bd423ad6cda
nodejs-10.16.3-2.module+el8.0.0+4214+49953fda.aarch64.rpm SHA-256: 488db18e726efa1ad818ab5c252c924e57368a0f15a66bdd83f10da818cfd47c
nodejs-debuginfo-10.16.3-2.module+el8.0.0+4214+49953fda.aarch64.rpm SHA-256: 19990a07bcad9e52cdf2fa2fb1b0a252a4c0c7030beea7e73d85ef78809a86df
nodejs-debugsource-10.16.3-2.module+el8.0.0+4214+49953fda.aarch64.rpm SHA-256: 73a34e08ac1d34a13cf2d130706635fefad4ec2a5684eeb135ef743ab55f115a
nodejs-devel-10.16.3-2.module+el8.0.0+4214+49953fda.aarch64.rpm SHA-256: c451964bc938ab79b9cfee3a843e79a9e15f84a2ceb19e925db8c2dff50d1969
npm-6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda.aarch64.rpm SHA-256: d332740a3120127ddbf1c18115f81e4576cd567235b52d2e7029f05578719395

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.