Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.0666 February 2019 Security Releases 4 March 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Node.js Publisher: Node.js Operating System: Windows UNIX variants (UNIX, Linux, OSX) BSD variants Impact/Access: Access Privileged Data -- Remote with User Interaction Denial of Service -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2019-5739 CVE-2019-5737 CVE-2019-1559 CVE-2018-12121 Reference: ESB-2019.0649 ESB-2019.0630 ESB-2019.0620 Original Bulletin: https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/ - --------------------------BEGIN INCLUDED TEXT-------------------- February 2019 Security Releases by Rod Vagg, 2019-02-28 (Update 28-February-2018) Security releases available Summary Updates are now available for all active Node.js release lines. In addition to fixes for security flaws in Node.js, they also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2r which contains a fix for a moderate severity security vulnerability. The original announcement is included below. For these releases, we have decided to withhold the fix for the Misinterpretation of Input (CWE-115) flaw mentioned in the original announcement. This flaw is very low severity and we are not satisfied that we had a complete and stable fix ready for release. We will be seeking to address this flaw via alternate mechanisms in the near future. In addition, we have introduced an additional CVE for a change in Node.js 6 that we have decided to classify as a Denial of Service (CWE-400) flaw. We recommend that all Node.js users upgrade to a version listed below as soon as possible. Downloads & release details Downloads are available for the following versions. Details of code changes can also be found on each release page. o Node.js 11.10.1 (Current) o Node.js 10.15.2 (LTS "Dubnium") o Node.js 8.15.1 (LTS "Carbon") o Node.js 6.17.0 (LTS "Boron") Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737) Categorization: Uncontrolled Resource Consumption / Denial of Service (CWE-400) All actively supported release lines are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly thereby keeping the connection and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November, 2018. The 40 second timeout and its adjustment by server.headersTimeout apply to this fix as in CVE-2018-12121. CVE-2018-12121 originally reported by Jan Maybach (liebdich.com), keep-alive variant reported by Marco Pracucci), fixed by Matteo Collina. Impact: o All versions of Node.js 6 (LTS "Boron") are vulnerable o All versions of Node.js 8 (LTS "Carbon") are vulnerable o All versions of Node.js 10 (LTS "Dubnium") are vulnerable o All versions of Node.js 11 (Current) are vulnerable Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739) Categorization: Uncontrolled Resource Consumption / Denial of Service (CWE-400) Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default. The original fix was submitted by Timur Shemsedinov) and backported by Matteo Collina. Impact: o All versions of Node.js 6 (LTS "Boron") are vulnerable o All versions of Node.js 8 (LTS "Carbon") are NOT vulnerable o All versions of Node.js 10 (LTS "Dubnium") are NOT vulnerable o All versions of Node.js 11 (Current) are NOT vulnerable OpenSSL: 0-byte record padding oracle (CVE-2019-1559) Severity: MODERATE OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only. Node.js 10 and 11 are not impacted by this vulnerability as they use newer versions of OpenSSL which do not contain the flaw. Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid padding compared to a zero-byte record with an invalid MAC. This can be used as the basis of a padding oracle attack to decrypt data. Only TLS connections using certain ciphersuites executing under certain conditions are exploitable. We are currently unable to determine whether the use of OpenSSL in Node.js exposes this vulnerability. We are taking a cautionary approach and recommend the same for users. For more information, see the advisory and a detailed write-up by the reporters of the vulnerability. Impact: o All versions of Node.js 6 (LTS "Boron") are vulnerable o All versions of Node.js 8 (LTS "Carbon") are vulnerable o All versions of Node.js 10 (LTS "Dubnium") are NOT vulnerable o All versions of Node.js 11 (Current) are NOT vulnerable Acknowledgements Matteo Collina for vulnerability fixes. Shigeki Ohtsu and Sam Roberts for the OpenSSL upgrade. Jan Maybach and Marco Pracucci for reporting vulnerabilities via the appropriate channels (see below). Other members of the Node.js security team for reviews and discussion. Original post is included below Summary The Node.js project will release new versions of all supported release lines on, or shortly after, Wednesday, February 27th, 2019 UTC. These releases will incorporate at least two security fixes specific to Node.js, the highest severity of which is 'low'. The OpenSSL project has announced releases for the 26th which may impact some release lines of Node.js and require inclusion in our security releases. The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2 which is used by Node.js 6.x and 8.x. A bug-fix release for OpenSSL 1.1.1 will also be made available and we will assess the impact, if any, on Node.js 11.x which uses this version. Node.js 10.x will not be impacted by the OpenSSL releases. Impact Releases for all actively supported release lines will be made available to fix the following vulnerabilities. All versions of Node.js 6 (LTS "Boron") are vulnerable to: o 1 Uncontrolled Resource Consumption / Denial of Service (CWE-400) vulnerability o 1 Misinterpretation of Input (CWE-115) vulnerability o Possible update to OpenSSL 1.0.2r depending on assessed impact All versions of Node.js 8 (LTS "Carbon") are vulnerable to: o 1 Uncontrolled Resource Consumption / Denial of Service (CWE-400) vulnerability o 1 Misinterpretation of Input (CWE-115) vulnerability o Possible update to OpenSSL 1.0.2r depending on assessed impact All versions of Node.js 10 (LTS "Dubnium") are vulnerable to: o 1 Uncontrolled Resource Consumption / Denial of Service (CWE-400) vulnerability o 1 Misinterpretation of Input (CWE-115) vulnerability All versions of Node.js 11 (Current) are vulnerable to: o 1 Uncontrolled Resource Consumption / Denial of Service (CWE-400) vulnerability o 1 Misinterpretation of Input (CWE-115) vulnerability o Possible update to OpenSSL 1.1.1b depending on assessed impact Release timing Releases will be available at, or shortly after, Wednesday, February 27th, 2019 UTC, along with disclosure of the details for the flaws addressed in each release in order to allow for complete impact assessment by users. Contact and future updates The current Node.js security policy can be found at https://nodejs.org/en/ security/. Please contact [email protected] if you wish to report a vulnerability in Node.js. Subscribe to the low-volume announcement-only nodejs-sec mailing list at https: //groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. ? Scroll to top Linux Foundation Collaborative Projects o Report Node.js issue o Report website issue o Get Help (C) Node.js Foundation. All Rights Reserved. Portions of this site originally (C) Joyent. Node.js is a trademark of Joyent, Inc. and is used with its permission. Please review the Trademark Guidelines of the Node.js Foundation. Linux Foundation is a registered trademark of The Linux Foundation. Linux is a registered trademark of Linus Torvalds. Node.js Project Licensing Information. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXHzBM2aOgq3Tt24GAQjNrhAAhbtacT3cPArukvAUY74a6TkC4aZx2JdY IUys2yJW3BRl7yN69RwAJN1oU8zFWgPrVEmWvE0yLCZTs0AmbVB9RS2fREywngLt p5NOlInbZXb9REjD5otlLu6KtrJvNi/Cn3JVCew0ofcOTeAtnyDfHWQpAh55nxXA xm47fdyrwpaWecvrpbmbsHC36tDryAsGbhjcXTqgTWFNA61yDYIg05PmlWKkcfCt eLDCNaw/HjU2MQcINQzHhhhxdqsRx4soYfPUMJswtSY3EO1xuuzuxAxrPHw0ee5/ lpQPqvqyaxJteLD6fVkFY+bMD3PcYqNf/iu54wFbPh+h7eOfxCjyZYNadKpAtohM KZkcNJPm9WHTLFev/dHMdPwQGtUECLv8dWDwF71Pmt4ss8CXC7KdwgLulMu8ePO9 dzKBNJT1KObefEmfjlhO3Hg57fYLVecsT7N6q2yysXj16eVToL/t9XY/6PoM57Y9 rQcXXBJd+5DyHkc5eKIXXEV9YKH/Mnjr0C210mG4ny09otvWnjqFqOEoBDh4rgjz z9gmtT3VBr8rS6rJ9DBeu50nr4D/pYRzhQnf0QggxuMOYwIBjFhJ+La/WVIK06Hu U01Ts7MSUBacDY7MuF880hZbGDJ44sW+f0nKFZaHInCh+MeYxoC3qHNDtlbz3jgW ruWfwXPIfP4= =Akuz -----END PGP SIGNATURE-----