CVE-2019-5737

{"containers": {"cna": {"affected": [{"product": "Node.js", "vendor": "Node.js", "versions": [{"status": "affected", "version": "All versions prior to 6.17.0"}, {"status": "affected", "version": "All versions prior to 8.15.1"}, {"status": "affected", "version": "All versions prior to 10.15.2"}, {"status": "affected", "version": "All versions prior to 11.10.1"}]}], "datePublic": "2019-02-28T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption / Denial of Service", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-03-20T20:06:11.000Z", "orgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558", "shortName": "nodejs"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"}, {"name": "openSUSE-SU-2019:1076", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"}, {"name": "openSUSE-SU-2019:1173", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"}, {"name": "openSUSE-SU-2019:1211", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"}, {"name": "RHSA-2019:1821", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:1821"}, {"name": "GLSA-202003-48", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/202003-48"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-request@iojs.org", "ID": "CVE-2019-5737", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Node.js", "version": {"version_data": [{"version_value": "All versions prior to 6.17.0"}, {"version_value": "All versions prior to 8.15.1"}, {"version_value": "All versions prior to 10.15.2"}, {"version_value": "All versions prior to 11.10.1"}]}}]}, "vendor_name": "Node.js"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-400: Uncontrolled Resource Consumption / Denial of Service"}]}]}, "references": {"reference_data": [{"name": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/", "refsource": "MISC", "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"}, {"name": "openSUSE-SU-2019:1076", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"}, {"name": "openSUSE-SU-2019:1173", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"}, {"name": "openSUSE-SU-2019:1211", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"}, {"name": "https://security.netapp.com/advisory/ntap-20190502-0008/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"}, {"name": "RHSA-2019:1821", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1821"}, {"name": "GLSA-202003-48", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202003-48"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T20:01:52.386Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"}, {"name": "openSUSE-SU-2019:1076", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"}, {"name": "openSUSE-SU-2019:1173", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"}, {"name": "openSUSE-SU-2019:1211", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"}, {"name": "RHSA-2019:1821", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:1821"}, {"name": "GLSA-202003-48", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/202003-48"}]}]}, "cveMetadata": {"assignerOrgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558", "assignerShortName": "nodejs", "cveId": "CVE-2019-5737", "datePublished": "2019-03-28T16:20:28.000Z", "dateReserved": "2019-01-09T00:00:00.000Z", "dateUpdated": "2024-08-04T20:01:52.386Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Node.js", "vendor": "Node.js", "versions": [{"status": "affected", "version": "All versions prior to 6.17.0"}, {"status": "affected", "version": "All versions prior to 8.15.1"}, {"status": "affected", "version": "All versions prior to 10.15.2"}, {"status": "affected", "version": "All versions prior to 11.10.1"}]}], "source": "cve-request@iojs.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "2EC91F8D-516E-4BCE-848F-D3067204B6D5", "versionEndExcluding": "6.17.0", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "151F282C-7B94-4D92-9D3E-6562533D0863", "versionEndExcluding": "8.15.1", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "1B262406-C8BB-40CA-8082-162EE67CD864", "versionEndExcluding": "10.15.2", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "AC79D17F-2042-4153-8BD6-EC6F621123B2", "versionEndExcluding": "11.10.1", "versionStartIncluding": "11.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*", "matchCriteriaId": "5F65DAB0-3DAD-49FF-BC73-3581CC3D5BF3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1."}, {"lang": "es", "value": "En Node.js, que incluye la versi\u00f3n 6.x en versiones anteriores a la 6.17.0, 8.x en versiones anteriores a la 8.15.1, 10.x en versiones anteriores a la 10.15.2 y 11.x en versiones anteriores a la 11.10.1, un atacante puede provocar una denegaci\u00f3n de servicio (DoS) instalando una conexi\u00f3n HTTP o HTTPS en modo keep-alive y enviando encabezados muy lentamente. Esto mantiene la conexi\u00f3n y los recursos asociados activos durante un largo per\u00edodo de tiempo. Los posibles ataques se ven reducido mediante el uso de un equilibrador de carga u otra capa proxy. Esta vulnerabilidad es una extensi\u00f3n de CVE-2018-12121, abordada en noviembre y afecta a todas las l\u00edneas de versi\u00f3n activas de Node.js, incluidas 6.x en versiones anteriores a la 6.17.0, 8.x en versiones anteriores a la 8.15.1, 10.x en versiones anteriores a la 10.15.2, y 11.x en versiones anteriores a la 11.10.1."}], "id": "CVE-2019-5737", "lastModified": "2026-06-17T02:38:07.820", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-03-28T17:29:01.567", "references": [{"source": "cve-request@iojs.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"}, {"source": "cve-request@iojs.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"}, {"source": "cve-request@iojs.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"}, {"source": "cve-request@iojs.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:1821"}, {"source": "cve-request@iojs.org", "tags": ["Third Party Advisory"], "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"}, {"source": "cve-request@iojs.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202003-48"}, {"source": "cve-request@iojs.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:1821"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202003-48"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"}], "sourceIdentifier": "cve-request@iojs.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "cve-request@iojs.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2019:2925", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nodejs:10-8000020190911085529.f8e95b4e", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2019-09-30T00:00:00Z"}, {"advisory": "RHSA-2019:1821", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs8-nodejs-0:8.16.0-1.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2019-07-22T00:00:00Z"}, {"advisory": "RHSA-2019:2939", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-0:3.2-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2019-10-01T00:00:00Z"}, {"advisory": "RHSA-2019:2939", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-nodejs-0:10.16.3-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2019-10-01T00:00:00Z"}, {"advisory": "RHSA-2019:1821", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs8-nodejs-0:8.16.0-1.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS", "release_date": "2019-07-22T00:00:00Z"}, {"advisory": "RHSA-2019:1821", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs8-nodejs-0:8.16.0-1.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS", "release_date": "2019-07-22T00:00:00Z"}, {"advisory": "RHSA-2019:2939", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-0:3.2-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS", "release_date": "2019-10-01T00:00:00Z"}, {"advisory": "RHSA-2019:2939", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-nodejs-0:10.16.3-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS", "release_date": "2019-10-01T00:00:00Z"}, {"advisory": "RHSA-2019:1821", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs8-nodejs-0:8.16.0-1.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS", "release_date": "2019-07-22T00:00:00Z"}, {"advisory": "RHSA-2019:2939", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-0:3.2-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS", "release_date": "2019-10-01T00:00:00Z"}, {"advisory": "RHSA-2019:2939", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-nodejs-0:10.16.3-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS", "release_date": "2019-10-01T00:00:00Z"}, {"advisory": "RHSA-2019:2939", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-0:3.2-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS", "release_date": "2019-10-01T00:00:00Z"}, {"advisory": "RHSA-2019:2939", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-nodejs-0:10.16.3-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS", "release_date": "2019-10-01T00:00:00Z"}], "bugzilla": {"description": "nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass", "id": "1690808", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1690808"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "verified"}, "cwe": "CWE-400", "details": ["In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.", "It was found that the original fix for Slowloris, CVE-2018-12122, was insufficient. It is possible to bypass the server's headersTimeout by sending two specially crafted HTTP requests in the same connection. An attacker could use this flaw to bypass Slowloris protection, resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "The use of a Load Balancer or a Reverse Proxy will increase the difficulty of the attack."}, "name": "CVE-2019-5737", "package_state": [{"cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0", "fix_state": "Not affected", "package_name": "nodejs10", "product_name": "Red Hat OpenShift Application Runtimes"}, {"cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0", "fix_state": "Not affected", "package_name": "nodejs8", "product_name": "Red Hat OpenShift Application Runtimes"}, {"cpe": "cpe:/a:redhat:openshift:3.10", "fix_state": "Fix deferred", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.10"}, {"cpe": "cpe:/a:redhat:openshift:3.6", "fix_state": "Fix deferred", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.6"}, {"cpe": "cpe:/a:redhat:openshift:3.7", "fix_state": "Out of support scope", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.7"}, {"cpe": "cpe:/a:redhat:openshift:3.9", "fix_state": "Fix deferred", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.9"}], "public_date": "2019-02-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-5737\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-5737\nhttps://nodejs.org/ja/blog/vulnerability/february-2019-security-releases/"], "threat_severity": "Low"}

{}