Bug 1591872 (CVE-2017-16014)

Summary:	CVE-2017-16014 nodejs-http-proxy: DOS via improper error handling in middleware implementation
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NEXTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahardin, bleanhar, ccoleman, dedgar, jgoulding, jokerman, kseifried, mchappel, pnemade, psampaio
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-http-proxy 0.7.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-06-24 09:24:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1591874
Bug Blocks:	1591875

Description Pedro Sampaio 2018-06-15 17:47:29 UTC

Affected versions of http-proxy are vulnerable to a denial of service attack, wherein an attacker can force an error which will cause the server to crash.

Upstream issue:

https://github.com/nodejitsu/node-http-proxy/pull/101

External references:

https://nodesecurity.io/advisories/323

Comment 1 Pedro Sampaio 2018-06-15 17:48:12 UTC

Created nodejs-http-proxy tracking bugs for this issue:

Affects: fedora-all [bug 1591874]

Comment 2 Parag Nemade 2018-06-16 09:19:53 UTC

May I know why you think given https://github.com/nodejitsu/node-http-proxy/pull/101 patch is not already present in Fedora?

The current Fedora release for this package is nodejs-http-proxy-1.16.2-5.fc28.noarch and is based on upstream release 1.16.2 which got released in December 2016.

The patch you given in description is already merged in upstream since long time.

Comment 3 Andrej Nemec 2018-06-21 12:12:34 UTC

(In reply to Parag Nemade from comment #2)
> May I know why you think given
> https://github.com/nodejitsu/node-http-proxy/pull/101 patch is not already
> present in Fedora?
> 
> The current Fedora release for this package is
> nodejs-http-proxy-1.16.2-5.fc28.noarch and is based on upstream release
> 1.16.2 which got released in December 2016.
> 
> The patch you given in description is already merged in upstream since long
> time.

Hi,

This definitely looks like an error, I'll change the status to notaffected and close the associated tracking bug. Thanks for the info!