CVE-2019-15605

CRITICAL

9.8

Description

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published2/7/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

debian:debian_linuxfedoraproject:fedoranodejs:node.jsopensuse:leaporacle:graalvmredhat:enterprise_linuxredhat:enterprise_linux_desktopredhat:enterprise_linux_eusredhat:enterprise_linux_serverredhat:enterprise_linux_server_ausredhat:enterprise_linux_server_tusredhat:enterprise_linux_workstationredhat:software_collections

Weaknesses (CWE)

CWE-444CWE-444

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html(support@hackerone.com)

https://access.redhat.com/errata/RHSA-2020:0573(support@hackerone.com)

https://access.redhat.com/errata/RHSA-2020:0579(support@hackerone.com)

https://access.redhat.com/errata/RHSA-2020:0597(support@hackerone.com)

https://access.redhat.com/errata/RHSA-2020:0598(support@hackerone.com)

https://access.redhat.com/errata/RHSA-2020:0602(support@hackerone.com)

https://access.redhat.com/errata/RHSA-2020:0703(support@hackerone.com)

https://access.redhat.com/errata/RHSA-2020:0707(support@hackerone.com)

https://access.redhat.com/errata/RHSA-2020:0708(support@hackerone.com)

https://hackerone.com/reports/735748(support@hackerone.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/(support@hackerone.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/(support@hackerone.com)

https://nodejs.org/en/blog/release/v10.19.0/(support@hackerone.com)

https://nodejs.org/en/blog/release/v12.15.0/(support@hackerone.com)

https://nodejs.org/en/blog/release/v13.8.0/(support@hackerone.com)

https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/(support@hackerone.com)

https://security.gentoo.org/glsa/202003-48(support@hackerone.com)

https://security.netapp.com/advisory/ntap-20200221-0004/(support@hackerone.com)

https://www.debian.org/security/2020/dsa-4669(support@hackerone.com)

https://www.oracle.com//security-alerts/cpujul2021.html(support@hackerone.com)

https://www.oracle.com/security-alerts/cpuapr2020.html(support@hackerone.com)

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0573(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0579(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0597(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0598(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0602(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0703(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0707(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0708(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/reports/735748(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/(af854a3a-2127-422b-91ae-364da2661108)

https://nodejs.org/en/blog/release/v10.19.0/(af854a3a-2127-422b-91ae-364da2661108)

https://nodejs.org/en/blog/release/v12.15.0/(af854a3a-2127-422b-91ae-364da2661108)

https://nodejs.org/en/blog/release/v13.8.0/(af854a3a-2127-422b-91ae-364da2661108)

https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202003-48(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20200221-0004/(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2020/dsa-4669(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com//security-alerts/cpujul2021.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuapr2020.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.