Bug 1965488 (CVE-2021-32640)

Summary:	CVE-2021-32640 nodejs-ws: Specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	adudiak, anpicker, aos-bugs, bcoca, bmontgom, eparis, gblomqui, gparvin, hvyas, jburrell, jcammara, jhadvig, jhardy, jobarker, jweiser, jwendell, kaycoth, kshier, mabashia, nodejs-sig, nstielau, rcernich, rfreiman, rpetrell, smcdonal, spasquie, sponnaga, stcannon, tdawson, tfister, thee, twalsh, viktor.vix.jancik, vmugicag, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ws 7.4.6, ws 6.2.2, ws 5.2.3	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in nodejs-ws. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1970255, 1970781, 1971615, 1965489, 1965490, 1967928, 1967929, 1967930, 1967931, 1969462, 1969464, 1969465, 1969466, 1971427, 1972663, 1972665, 1972666, 1972667, 1972668, 1972669, 1972670, 1972671, 1972672, 1972673, 1972674, 1972675
Bug Blocks:	1965491

Description Pedro Sampaio 2021-05-27 19:32:34 UTC

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

References:

https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693
https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff

Comment 1 Pedro Sampaio 2021-05-27 19:33:20 UTC

Created nodejs-ws tracking bugs for this issue:

Affects: epel-7 [bug 1965490]
Affects: fedora-33 [bug 1965489]

Comment 8 Tapas Jena 2021-06-11 08:03:18 UTC

Analysis is complete for Ansible Automation Platform and found that Ansible Tower is using affected version of ws. Creating required trackers.