All actively supported release lines are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly thereby keeping the connection and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer. Reference: https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/
Created nodejs tracking bugs for this issue: Affects: fedora-all [bug 1690814]
Created nodejs tracking bugs for this issue: Affects: epel-7 [bug 1690815]
Upstream Commit: https://github.com/nodejs/node/commit/1a7302bd48
External References: https://nodejs.org/ja/blog/vulnerability/february-2019-security-releases/
Mitigation: The use of a Load Balancer or a Reverse Proxy will increase the difficulty of the attack.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:1821 https://access.redhat.com/errata/RHSA-2019:1821
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-5737
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2019:2939 https://access.redhat.com/errata/RHSA-2019:2939
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:2939 https://access.redhat.com/errata/RHSA-2019:2925