CVE-2019-5737

Upstream information

CVE-2019-5737 at MITRE

Description

In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.

---

SUSE information

SUSE Bugzilla entry: 1127532 [RESOLVED / FIXED]

SUSE Security Advisories:

• SUSE-SU-2019:0627-1, published
• SUSE-SU-2019:0635-1, published
• SUSE-SU-2019:0636-1, published
• SUSE-SU-2019:0658-1, published Wed Mar 20 10:37:52 MDT 2019
• SUSE-SU-2019:0818-1, published Fri Mar 29 17:13:00 MDT 2019
• SUSE-SU-2019:14246-1, published Wed Dec 11 13:19:40 MST 2019
• openSUSE-SU-2019:1076-1, published Thu, 28 Mar 2019 21:11:37 +0100 (CET)
• openSUSE-SU-2019:1173-1, published Mon, 8 Apr 2019 15:32:57 +0200 (CEST)
• openSUSE-SU-2019:1211-1, published Tue, 16 Apr 2019 15:09:09 +0200 (CEST)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Enterprise Storage 4	nodejs4 >= 4.9.1-15.20.1 nodejs6 >= 6.17.0-11.24.1	Patchnames: SUSE-Storage-4-2019-658 SUSE-Storage-4-2019-818
SUSE Linux Enterprise Module for Web Scripting 12	nodejs10 >= 10.15.2-1.6.1 nodejs10-devel >= 10.15.2-1.6.1 nodejs10-docs >= 10.15.2-1.6.1 nodejs4 >= 4.9.1-15.20.1 nodejs4-devel >= 4.9.1-15.20.1 nodejs4-docs >= 4.9.1-15.20.1 nodejs6 >= 6.17.0-11.24.1 nodejs6-devel >= 6.17.0-11.24.1 nodejs6-docs >= 6.17.0-11.24.1 npm10 >= 10.15.2-1.6.1 npm4 >= 4.9.1-15.20.1 npm6 >= 6.17.0-11.24.1	Patchnames: SUSE-SLE-Module-Web-Scripting-12-2019-636 SUSE-SLE-Module-Web-Scripting-12-2019-658 SUSE-SLE-Module-Web-Scripting-12-2019-818
SUSE Linux Enterprise Module for Web Scripting 15	nodejs10 >= 10.15.2-1.6.1 nodejs10-devel >= 10.15.2-1.6.1 nodejs10-docs >= 10.15.2-1.6.1 nodejs8 >= 8.15.1-3.14.1 nodejs8-devel >= 8.15.1-3.14.1 nodejs8-docs >= 8.15.1-3.14.1 npm10 >= 10.15.2-1.6.1 npm8 >= 8.15.1-3.14.1	Patchnames: SUSE-SLE-Module-Web-Scripting-15-2019-627 SUSE-SLE-Module-Web-Scripting-15-2019-635
SUSE Linux Enterprise Module for Web Scripting 15 SP1	nodejs10 >= 10.15.2-1.6.1 nodejs10-devel >= 10.15.2-1.6.1 nodejs10-docs >= 10.15.2-1.6.1 nodejs8 >= 8.15.1-3.14.1 nodejs8-devel >= 8.15.1-3.14.1 nodejs8-docs >= 8.15.1-3.14.1 npm10 >= 10.15.2-1.6.1 npm8 >= 8.15.1-3.14.1	Patchnames: SUSE Linux Enterprise Module for Web Scripting 15 SP1 GA nodejs10 SUSE Linux Enterprise Module for Web Scripting 15 SP1 GA nodejs8
SUSE Linux Enterprise Server 11 SP4-LTSS	MozillaFirefox >= 68.2.0-78.51.4 MozillaFirefox-branding-SLED >= 68-21.9.8 MozillaFirefox-translations-common >= 68.2.0-78.51.4 MozillaFirefox-translations-other >= 68.2.0-78.51.4 firefox-atk >= 2.26.1-2.8.4 firefox-atk-lang >= 2.26.1-2.8.4 firefox-cairo >= 1.15.10-2.13.4 firefox-gdk-pixbuf >= 2.36.11-2.8.4 firefox-gdk-pixbuf-lang >= 2.36.11-2.8.4 firefox-gdk-pixbuf-query-loaders >= 2.36.11-2.8.4 firefox-gdk-pixbuf-thumbnailer >= 2.36.11-2.8.4 firefox-gio-branding-upstream >= 2.54.3-2.14.7 firefox-glib2 >= 2.54.3-2.14.7 firefox-glib2-lang >= 2.54.3-2.14.7 firefox-glib2-tools >= 2.54.3-2.14.7 firefox-gtk3 >= 3.10.9-2.15.3 firefox-gtk3-branding-upstream >= 3.10.9-2.15.3 firefox-gtk3-data >= 3.10.9-2.15.3 firefox-gtk3-immodule-amharic >= 3.10.9-2.15.3 firefox-gtk3-immodule-inuktitut >= 3.10.9-2.15.3 firefox-gtk3-immodule-multipress >= 3.10.9-2.15.3 firefox-gtk3-immodule-thai >= 3.10.9-2.15.3 firefox-gtk3-immodule-vietnamese >= 3.10.9-2.15.3 firefox-gtk3-immodule-xim >= 3.10.9-2.15.3 firefox-gtk3-immodules-tigrigna >= 3.10.9-2.15.3 firefox-gtk3-lang >= 3.10.9-2.15.3 firefox-gtk3-tools >= 3.10.9-2.15.3 firefox-harfbuzz >= 1.7.5-2.7.4 firefox-libatk-1_0-0 >= 2.26.1-2.8.4 firefox-libcairo-gobject2 >= 1.15.10-2.13.4 firefox-libcairo2 >= 1.15.10-2.13.4 firefox-libffi >= 3.2.1.git259-2.3.3 firefox-libffi-gcc5 >= 5.3.1+r233831-14.1 firefox-libffi4 >= 5.3.1+r233831-14.1 firefox-libffi7 >= 3.2.1.git259-2.3.3 firefox-libgdk_pixbuf-2_0-0 >= 2.36.11-2.8.4 firefox-libgtk-3-0 >= 3.10.9-2.15.3 firefox-libharfbuzz0 >= 1.7.5-2.7.4 firefox-libpango-1_0-0 >= 1.40.14-2.7.4 firefox-pango >= 1.40.14-2.7.4 libfirefox-gio-2_0-0 >= 2.54.3-2.14.7 libfirefox-glib-2_0-0 >= 2.54.3-2.14.7 libfirefox-gmodule-2_0-0 >= 2.54.3-2.14.7 libfirefox-gobject-2_0-0 >= 2.54.3-2.14.7 libfirefox-gthread-2_0-0 >= 2.54.3-2.14.7 libfreebl3 >= 3.45-38.9.3 libfreebl3-32bit >= 3.45-38.9.3 libsoftokn3 >= 3.45-38.9.3 libsoftokn3-32bit >= 3.45-38.9.3 mozilla-nspr >= 4.21-29.6.1 mozilla-nspr-32bit >= 4.21-29.6.1 mozilla-nspr-devel >= 4.21-29.6.1 mozilla-nss >= 3.45-38.9.3 mozilla-nss-32bit >= 3.45-38.9.3 mozilla-nss-certs >= 3.45-38.9.3 mozilla-nss-certs-32bit >= 3.45-38.9.3 mozilla-nss-devel >= 3.45-38.9.3 mozilla-nss-tools >= 3.45-38.9.3	Patchnames: slessp4-firefox-201910-14246
SUSE Linux Enterprise Server for SAP Applications 11 SP4-LTSS	MozillaFirefox >= 68.2.0-78.51.4 MozillaFirefox-branding-SLED >= 68-21.9.8 MozillaFirefox-translations-common >= 68.2.0-78.51.4 MozillaFirefox-translations-other >= 68.2.0-78.51.4 firefox-atk >= 2.26.1-2.8.4 firefox-atk-lang >= 2.26.1-2.8.4 firefox-cairo >= 1.15.10-2.13.4 firefox-gdk-pixbuf >= 2.36.11-2.8.4 firefox-gdk-pixbuf-lang >= 2.36.11-2.8.4 firefox-gdk-pixbuf-query-loaders >= 2.36.11-2.8.4 firefox-gdk-pixbuf-thumbnailer >= 2.36.11-2.8.4 firefox-gio-branding-upstream >= 2.54.3-2.14.7 firefox-glib2 >= 2.54.3-2.14.7 firefox-glib2-lang >= 2.54.3-2.14.7 firefox-glib2-tools >= 2.54.3-2.14.7 firefox-gtk3 >= 3.10.9-2.15.3 firefox-gtk3-branding-upstream >= 3.10.9-2.15.3 firefox-gtk3-data >= 3.10.9-2.15.3 firefox-gtk3-immodule-amharic >= 3.10.9-2.15.3 firefox-gtk3-immodule-inuktitut >= 3.10.9-2.15.3 firefox-gtk3-immodule-multipress >= 3.10.9-2.15.3 firefox-gtk3-immodule-thai >= 3.10.9-2.15.3 firefox-gtk3-immodule-vietnamese >= 3.10.9-2.15.3 firefox-gtk3-immodule-xim >= 3.10.9-2.15.3 firefox-gtk3-immodules-tigrigna >= 3.10.9-2.15.3 firefox-gtk3-lang >= 3.10.9-2.15.3 firefox-gtk3-tools >= 3.10.9-2.15.3 firefox-harfbuzz >= 1.7.5-2.7.4 firefox-libatk-1_0-0 >= 2.26.1-2.8.4 firefox-libcairo-gobject2 >= 1.15.10-2.13.4 firefox-libcairo2 >= 1.15.10-2.13.4 firefox-libffi >= 3.2.1.git259-2.3.3 firefox-libffi-gcc5 >= 5.3.1+r233831-14.1 firefox-libffi4 >= 5.3.1+r233831-14.1 firefox-libffi7 >= 3.2.1.git259-2.3.3 firefox-libgdk_pixbuf-2_0-0 >= 2.36.11-2.8.4 firefox-libgtk-3-0 >= 3.10.9-2.15.3 firefox-libharfbuzz0 >= 1.7.5-2.7.4 firefox-libpango-1_0-0 >= 1.40.14-2.7.4 firefox-pango >= 1.40.14-2.7.4 libfirefox-gio-2_0-0 >= 2.54.3-2.14.7 libfirefox-glib-2_0-0 >= 2.54.3-2.14.7 libfirefox-gmodule-2_0-0 >= 2.54.3-2.14.7 libfirefox-gobject-2_0-0 >= 2.54.3-2.14.7 libfirefox-gthread-2_0-0 >= 2.54.3-2.14.7 libfreebl3 >= 3.45-38.9.3 libfreebl3-32bit >= 3.45-38.9.3 libsoftokn3 >= 3.45-38.9.3 libsoftokn3-32bit >= 3.45-38.9.3 mozilla-nspr >= 4.21-29.6.1 mozilla-nspr-32bit >= 4.21-29.6.1 mozilla-nspr-devel >= 4.21-29.6.1 mozilla-nss >= 3.45-38.9.3 mozilla-nss-32bit >= 3.45-38.9.3 mozilla-nss-certs >= 3.45-38.9.3 mozilla-nss-certs-32bit >= 3.45-38.9.3 mozilla-nss-devel >= 3.45-38.9.3 mozilla-nss-tools >= 3.45-38.9.3	Patchnames: slessp4-firefox-201910-14246
SUSE OpenStack Cloud 7	nodejs6 >= 6.17.0-11.24.1	Patchnames: SUSE-OpenStack-Cloud-7-2019-818
SUSE OpenStack Cloud Crowbar 8	nodejs6 >= 6.17.0-11.24.1	Patchnames: SUSE-OpenStack-Cloud-Crowbar-8-2019-818
openSUSE Leap 15.0	nodejs8 >= 8.15.1-lp150.2.13.2 nodejs8-debuginfo >= 8.15.1-lp150.2.13.2 nodejs8-debugsource >= 8.15.1-lp150.2.13.2 nodejs8-devel >= 8.15.1-lp150.2.13.2 nodejs8-docs >= 8.15.1-lp150.2.13.2 npm8 >= 8.15.1-lp150.2.13.2	Patchnames: openSUSE-2019-1167
openSUSE Leap 42.3	nodejs10 >= 10.15.2-5.2 nodejs10-debuginfo >= 10.15.2-5.2 nodejs10-debugsource >= 10.15.2-5.2 nodejs10-devel >= 10.15.2-5.2 nodejs10-docs >= 10.15.2-5.2 nodejs4 >= 4.9.1-23.1 nodejs4-debuginfo >= 4.9.1-23.1 nodejs4-debugsource >= 4.9.1-23.1 nodejs4-devel >= 4.9.1-23.1 nodejs4-docs >= 4.9.1-23.1 nodejs6 >= 6.17.0-21.1 nodejs6-debuginfo >= 6.17.0-21.1 nodejs6-debugsource >= 6.17.0-21.1 nodejs6-devel >= 6.17.0-21.1 nodejs6-docs >= 6.17.0-21.1 npm10 >= 10.15.2-5.2 npm4 >= 4.9.1-23.1 npm6 >= 6.17.0-21.1	Patchnames: openSUSE-2019-1076 openSUSE-2019-1173 openSUSE-2019-1211