{
  "threat_severity" : "Low",
  "public_date" : "2016-01-19T00:00:00Z",
  "bugzilla" : {
    "description" : "nodejs-hawk: Long headers or URIs can cause minor DoS",
    "id" : "1309721",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"
  },
  "cvss" : {
    "cvss_base_score" : "5.0",
    "cvss_scoring_vector" : "AV:N/AC:L/Au:N/C:N/I:N/A:P",
    "status" : "draft"
  },
  "details" : [ "Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression." ],
  "statement" : "Red Hat Product Security has rated this issue as having Low security impact. Additionally nodejs-hawk is only present as a BuildRequires dependency in the nodejs-request package, the actual hawk functionality is not used in OpenShift Enterprise 3. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
  "package_state" : [ {
    "product_name" : "Red Hat OpenShift Enterprise 3.1",
    "fix_state" : "Under investigation",
    "package_name" : "nodejs-hawk",
    "cpe" : "cpe:/a:redhat:openshift:3.1"
  }, {
    "product_name" : "Red Hat Software Collections",
    "fix_state" : "Under investigation",
    "package_name" : "nodejs010-nodejs-hawk",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:2"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux",
    "fix_state" : "Under investigation",
    "package_name" : "rh-nodejs4-nodejs-hawk",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2016-2515\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-2515" ],
  "name" : "CVE-2016-2515",
  "csaw" : false
}