Red Hat Software Collections update for rh-nodejs8-nodejs

Published: 2019-07-22 | Updated: 2025-04-24

Risk	Medium
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2018-12116 CVE-2018-12121 CVE-2018-12122 CVE-2018-12123 CVE-2018-20834 CVE-2019-5737
CWE-ID	CWE-20 CWE-122 CWE-400 CWE-451 CWE-59
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	rh-nodejs8-nodejs (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Improper input validation

EUVDB-ID: #VU16171

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-12116

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to insufficient validation of user-provided input. A remote attacker can provide Unicode data for the path option of an HTTP request to trigger a second, unexpected, and user-defined HTTP request to made to the same server and cause the service to crash.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

rh-nodejs8-nodejs (Red Hat package): before 8.16.0-1.el7

CPE2.3

cpe:2.3:a:red_hat:rh-nodejs8-nodejs_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2019:1821

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU16168

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-12121

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow. A remote attacker can send many requests with the maximum size HTTP header of nearly 80kb/connection in combination with carefully handled completion of those headers, trigger memory corruption and cause the Node.js HTTP server to abort.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

rh-nodejs8-nodejs (Red Hat package): before 8.16.0-1.el7

CPE2.3

cpe:2.3:a:red_hat:rh-nodejs8-nodejs_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2019:1821

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource exhaustion

EUVDB-ID: #VU16169

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-12122

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to the socket is destroyed on the next received chunk when headers are not completely received within this period. A remote attacker can send headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time, consume excessive resources and cause the service to crash.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

rh-nodejs8-nodejs (Red Hat package): before 8.16.0-1.el7

CPE2.3

cpe:2.3:a:red_hat:rh-nodejs8-nodejs_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2019:1821

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Spoofing attack

EUVDB-ID: #VU16170

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-12123

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to conduct spoofing attack on the target system.

The vulnerability exists due to security decisions are made about the URL based on the hostname. A remote attacker can use a mixed case "javascript:" (e.g. "javAscript:") protocol and spoof the hostname when a Node.js application is using url.parse()to determine the URL hostname.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

rh-nodejs8-nodejs (Red Hat package): before 8.16.0-1.el7

CPE2.3

cpe:2.3:a:red_hat:rh-nodejs8-nodejs_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2019:1821

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Link following

EUVDB-ID: #VU71631

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-20834

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insecure following of hardlinks inside a tarball. A remote attacker can pass a specially crafted archive to the application and overwrite arbitrary files on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

rh-nodejs8-nodejs (Red Hat package): before 8.16.0-1.el7

CPE2.3

cpe:2.3:a:red_hat:rh-nodejs8-nodejs_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2019:1821

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU26284

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-5737

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect processing of keep-alive packets. A remote attacker can send keep-alive packets very slowly and trigger resource exhaustion.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

rh-nodejs8-nodejs (Red Hat package): before 8.16.0-1.el7

CPE2.3

cpe:2.3:a:red_hat:rh-nodejs8-nodejs_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2019:1821

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.