RHSA-2019:2925HighCVSS 7.5

Red Hat Security Advisory: nodejs:10 security update

Published
September 30, 2019
Last Modified
August 15, 2026

🔗 CVE IDs covered (9)

CVE-2019-9518 →CVE-2019-5737 →CVE-2019-9515 →CVE-2019-9517 →CVE-2019-9511 →CVE-2019-9512 →CVE-2019-9513 →CVE-2019-9514 →CVE-2019-9516 →

📋 Description

CVE-2019-5737 — nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass CVE-2019-9511 — HTTP/2: large amount of data requests leads to denial of service CVE-2019-9512 — HTTP/2: flood using PING frames results in unbounded memory growth CVE-2019-9513 — HTTP/2: flood using PRIORITY frames results in excessive resource consumption CVE-2019-9514 — HTTP/2: flood using HEADERS frames results in unbounded memory growth CVE-2019-9515 — HTTP/2: flood using SETTINGS frames results in unbounded memory growth CVE-2019-9516 — HTTP/2: 0-length headers lead to denial of service CVE-2019-9517 — HTTP/2: request for large response leads to denial of service CVE-2019-9518 — HTTP/2: flood using empty frames results in excessive resource consumption

🎯 Affected products28

  • Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.src (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:10.16.3-2.module+el8.0.0+4214+49953fda.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:10.16.3-2.module+el8.0.0+4214+49953fda.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:10.16.3-2.module+el8.0.0+4214+49953fda.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:10.16.3-2.module+el8.0.0+4214+49953fda.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:10.16.3-2.module+el8.0.0+4214+49953fda.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:10.16.3-2.module+el8.0.0+4214+49953fda.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:10.16.3-2.module+el8.0.0+4214+49953fda.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:10.16.3-2.module+el8.0.0+4214+49953fda.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:10.16.3-2.module+el8.0.0+4214+49953fda.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-debuginfo-1:10.16.3-2.module+el8.0.0+4214+49953fda.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-docs-1:10.16.3-2.module+el8.0.0+4214+49953fda.noarch (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The use of a Load Balancer or a Reverse Proxy will increase the difficulty of the attack. Workaround: Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions: 1. Copy the Nginx configuration from the quay container to the host $ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx 2. Edit the Nginx configuration, removing http/2 support $ sed -i 's/http2 //g' /mnt/quay/nginx/nginx.conf 3. Restart Nginx with the new configuration mounted into the container, eg: $ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3 Workaround: The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps: 1. Stop httpd service: $ systemctl stop httpd 2. Remove http/2 protocol support from configuration files: $ sed -i 's/\(h2\)\|\(h2c\)//g' <httpd_config_file> 3. Validate configuration files to make sure all syntax is valid: $ apachectl configtest 4. Restart httpd service: $ systemctl start httpd

🔗 References (11)