RHSA-2019:2939HighCVSS 7.5

Red Hat Security Advisory: rh-nodejs10-nodejs security update

Published
October 1, 2019
Last Modified
August 15, 2026

🔗 CVE IDs covered (12)

CVE-2019-9513 →CVE-2019-9517 →CVE-2019-9518 →CVE-2019-5737 →CVE-2019-9514 →CVE-2019-9515 →CVE-2019-9516 →CVE-2018-12121 →CVE-2018-12122 →CVE-2018-12123 →CVE-2019-9511 →CVE-2019-9512 →

📋 Description

CVE-2018-12121 — nodejs: Denial of Service with large HTTP headers CVE-2018-12122 — nodejs: Slowloris HTTP Denial of Service CVE-2018-12123 — nodejs: Hostname spoofing in URL parser for javascript protocol CVE-2019-5737 — nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass CVE-2019-9511 — HTTP/2: large amount of data requests leads to denial of service CVE-2019-9512 — HTTP/2: flood using PING frames results in unbounded memory growth CVE-2019-9513 — HTTP/2: flood using PRIORITY frames results in excessive resource consumption CVE-2019-9514 — HTTP/2: flood using HEADERS frames results in unbounded memory growth CVE-2019-9515 — HTTP/2: flood using SETTINGS frames results in unbounded memory growth CVE-2019-9516 — HTTP/2: 0-length headers lead to denial of service CVE-2019-9517 — HTTP/2: request for large response leads to denial of service CVE-2019-9518 — HTTP/2: flood using empty frames results in excessive resource consumption

🎯 Affected products118

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-nodejs10-0:3.2-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs10-0:3.2-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs10-0:3.2-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-nodejs10-0:3.2-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs10-0:3.2-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs10-0:3.2-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs10-0:3.2-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-nodejs10-0:3.2-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs10-0:3.2-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs10-0:3.2-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs10-0:3.2-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-nodejs10-0:3.2-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs10-0:3.2-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs10-0:3.2-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-nodejs10-0:3.2-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs10-0:3.2-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-nodejs10-0:3.2-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs10-0:3.2-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs10-0:3.2-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-nodejs10-nodejs-0:10.16.3-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs10-nodejs-0:10.16.3-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs10-nodejs-0:10.16.3-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-nodejs10-nodejs-0:10.16.3-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs10-nodejs-0:10.16.3-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs10-nodejs-0:10.16.3-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • +88 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The use of a Load Balancer or a Reverse Proxy will increase the difficulty of the attack. Workaround: Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions: 1. Copy the Nginx configuration from the quay container to the host $ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx 2. Edit the Nginx configuration, removing http/2 support $ sed -i 's/http2 //g' /mnt/quay/nginx/nginx.conf 3. Restart Nginx with the new configuration mounted into the container, eg: $ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3 Workaround: The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps: 1. Stop httpd service: $ systemctl stop httpd 2. Remove http/2 protocol support from configuration files: $ sed -i 's/\(h2\)\|\(h2c\)//g' <httpd_config_file> 3. Validate configuration files to make sure all syntax is valid: $ apachectl configtest 4. Restart httpd service: $ systemctl start httpd

🔗 References (11)