http-parser-2.7.1-8.el7
エラータID: AXSA:2019-4071:01
リリース日:
2019/08/19 Monday - 18:04
題名:
http-parser-2.7.1-8.el7
影響のあるチャネル:
Asianux Server 7 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- node.jsのhttp-parserには、コネクションごとおおよそ 80KB の
巨大なHTTPヘッダと大量のリクエストを組み合わせ、ヘッダの終了タイミングに
気をつけることによって、HTTPサーバーをヒープ割当の失敗により終了させる
ことができる脆弱性があります。(CVE-2018-12121)
- node.jsのhttp-parserには、`Content-Length` ヘッダのスペースを無視するため
HTTPの仕様と違う点がありました、セキュリティリスクとしてこの欠点が利用できる
可能性は大変低く、ひょっとすると不可能かもしれません。(CVE-2018-7159)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2018-12121
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
CVE-2018-7159
The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.
The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.
追加情報:
N/A
ダウンロード:
SRPMS
- http-parser-2.7.1-8.el7.src.rpm
MD5: b4e5517bf75cf3e248f948cbb7d4277a
SHA-256: 3456fdac90ba18018238d06dc1c0bceffc3f581d2be5aa468256db6c9990a12c
Size: 59.94 kB
Asianux Server 7 for x86_64
- http-parser-2.7.1-8.el7.x86_64.rpm
MD5: aa42946e589ed7e8d79002a544a830ce
SHA-256: cbd5c7b6e7d06e6d50295d0f258a01000fd5723bcec8562c5dbb4a021653df81
Size: 27.97 kB - http-parser-2.7.1-8.el7.i686.rpm
MD5: 644bef2730b6f115aca671281ce02ad7
SHA-256: 95084dbbcc4acda0678b71d43ef9a37d1f8590d91ad60dca5b253fff80c2a474
Size: 27.16 kB
English