Bug 1661002 (CVE-2018-12121)
Summary: | CVE-2018-12121 nodejs: Denial of Service with large HTTP headers | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Laura Pardo <lpardo> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | avibelli, bgeorges, cbuissar, dbeveniu, fidencio, hesilva, hhorak, jbalunas, jhrozek, jorton, jpallich, krathod, lthon, mszynkie, pgallagh, rruss, tjaros, trogers, zsvetlik |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | nodejs 6.15.0, nodejs 8.14.0, nodejs 10.14.0, nodejs 11.3.0 | Doc Type: | If docs needed, set a value |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2019-07-22 15:06:57 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1661004, 1661003, 1665986, 1665987, 1665988, 1666381, 1666382, 1720105, 1720106, 1720107, 1720108 | ||
Bug Blocks: | 1661014 |
Description
Laura Pardo
2018-12-19 19:45:15 UTC
Created nodejs tracking bugs for this issue: Affects: epel-all [bug 1661004] Affects: fedora-all [bug 1661003] Upstream fix: (master) https://github.com/nodejs/node/commit/18603524 (node.js 6) https://github.com/nodejs/node/commit/92231a56 Note: The original fix, reducing the maximum header length down to 8K (instead of 80K) has been found to lead to regressions. A 2nd commit added the ability to modify the maximum header size on the fly : Upstream fixes: For node.js : + https://github.com/nodejs/node/commit/cdcb1b77 + https://github.com/nodejs/node/commit/632f2633 For http-parser: + https://github.com/nodejs/http-parser/commit/0ae8d93f Statement: The nodejs RPMs shipped in Red Hat OpenShift Container Platform (OCP) versions 3.6 through 3.10 are vulnerable to this flaw because they contain the affected code. Later versions of OCP used nodejs RPMs delivered from Red Hat Software Collections and Red Hat Enterprise Linux channels. This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:1821 https://access.redhat.com/errata/RHSA-2019:1821 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-12121 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2258 https://access.redhat.com/errata/RHSA-2019:2258 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:3497 https://access.redhat.com/errata/RHSA-2019:3497 |