The version of Node.js installed on the remote host is 4.x prior to 4.9.0, 6.x prior to 6.14.0, 8.x prior to 8.11.0 or 9.x prior to 9.10.0. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2258 advisory.

    - Related: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser                               allowed for spaces inside Content-Length header                               values [rhel-7]
    - Resolves: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser                                allowed for spaces inside Content-Length header                                values [rhel-7]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2258 advisory.

    The http-parser package provides a utility for parsing HTTP messages. It parses both requests and     responses. The parser is designed to be used in performance HTTP applications. It does not make any system     calls or allocations, it does not buffer data, and it can be interrupted at any time. Depending on your     architecture, it only requires about 40 bytes of data per message stream.

    Security Fix(es):

    * nodejs: Denial of Service with large HTTP headers (CVE-2018-12121)

    * nodejs: HTTP parser allowed for spaces inside Content-Length header values (CVE-2018-7159)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - nodejs: Denial of Service with large HTTP headers     (CVE-2018-12121)

  - nodejs: HTTP parser allowed for spaces inside     Content-Length header values (CVE-2018-7159)

This update for nodejs6 fixes the following issues :

  - Fix some node-gyp permissions

  - New upstream LTS release 6.14.1 :

  - Security fixes :

  + CVE-2018-7160: Fix for inspector DNS rebinding     vulnerability (bsc#1087463)

  + CVE-2018-7158: Fix for 'path' module regular expression     denial of service (bsc#1087459)

  + CVE-2018-7159: Reject spaces in HTTP Content-Length     header values (bsc#1087453)

  - New upstream LTS release 6.13.1 :

  - http,tls: better support for IPv6 addresses

  - console: added console.count() and console.clear()

  - crypto :

  + expose ECDH class

  + added cypto.randomFill() and crypto.randomFillSync()

  + warn on invalid authentication tag length

  - deps: upgrade libuv to 1.16.1

  - dgram: added socket.setMulticastInterface()

  - http: add agent.keepSocketAlive and agent.reuseSocket as to allow overridable keep-alive behavior of Agent

  - lib: return this from net.Socket.end()

  - module: add builtinModules api that provides list of all     builtin modules in Node

  - net: return this from getConnections()

  - promises: more robust stringification for unhandled     rejections

  - repl: improve require() autocompletion

  - src :

  + add openssl-system-ca-path configure option

  + add --use-bundled-ca --use-openssl-ca check

  + add process.ppid

  - tls: accept lookup option for tls.connect()

  - tools,build: a new macOS installer!

  - url: WHATWG URL api support

  - util: add %i and %f formatting specifiers

  - remove any old manpage files in %pre from before     update-alternatives were used to manage symlinks to     these manpages.

  - Add Recommends and BuildRequire on python2 for npm.
    node-gyp requires this old version of python for now.
    This is only needed for binary modules.

  - even on recent codestreams there is no binutils gold on     s390 only on s390x

  - New upstream LTS release 6.12.3 :

  - v8: profiler-related fixes

  - mostly documentation and test related changes

  - Enable CI tests in %check target

This update was imported from the SUSE:SLE-12:Update update project.

Node.js 所有当前版本中的 HTTP 解析器都会忽略“Content-Length”标头中的空格，造成类似于“Content Length 的输入: 1 2”的输入被解释成值为“12”的情况。HTTP 规范不允许“Content-Length”值中存在空格，而 Node.js HTTP 解析器保留了这个特定差异。此缺陷对 Node.js 用户的安全风险可视为非常低，通过提供不正确的“Content-Length”值尚未实现的方式来利用此缺陷构建攻击非常困难，甚至不存在可能性。相较于所提供数据的实际长度，用户代码可能会对此值的潜在准确性做出错误假设，从而存在漏洞。建议构建低级别 HTTP 实用工具的 Node.js 用户在解析完成后，重新检查所提供的任何输入的长度。(CVE-2018-7159) 影响 BIG-IP 根据 CVE-2018-7159，不可能通过提供不正确的“Content-Length”值尚未实现的方式来利用此缺陷构建攻击。但当该缺陷受到利用时，可能会造成受影响的 Node.js 组件出现意外行为。BIG-IQ、F5 iWorkflow、Enterprise Manager 和 Traffix SDC 不存在影响；这些 F5 产品未受到此漏洞影响。

远程主机上安装的 Node.js 版本为低于 4.9.0 的 4.x、低于 6.14.0 的 6.x、低于 8.11.0 的 8.x 或低于 9.10.0 的 9.x。因此，该应用程序受到多个漏洞的影响。

请注意，Nessus 尚未测试这些问题，而是只依靠应用程序自我报告的版本号。

安全修复：- nodejs：使用大型 HTTP 标头拒绝服务 (CVE-2018-12121) - nodejs：HTTP 解析器允许 Content-Length 标头值内的空格 (CVE-2018-7159)

远程 Oracle Linux 7 主机上安装的多个程序包受到 ELSA-2019-2258 公告中提及的多个漏洞影响。

  - Node.js：Node.js 6.15.0 前的所有版本、8.14.0、10.14.0 和 11.3.0：具有大型 HTTP 标头拒绝服务：通过使用具有最大尺寸标头（每个连接约 80 KB）的许多请求和仔细计算完成时间的标头，有可能造成 HTTP 服务器因堆分配故障而中止。可使用负载均衡器或其他代理层缓解潜在攻击。(CVE-2018-12121)

  - Node.js 所有当前版本中的 HTTP 解析器都会忽略 `Content-Length` 标头中的空格，造成类似于“Content Length 的输入: 1 2”的输入被解释成值为“12”的情况。HTTP 规范不允许“Content-Length”值中存在空格，而 Node.js HTTP 解析器保留了这个特定差异。此缺陷对 Node.js 用户的安全风险可视为非常低，通过提供不正确的“Content-Length”值尚未实现的方式来利用此缺陷构建攻击非常困难，甚至不存在可能性。
    相较于所提供数据的实际长度，用户代码可能会对此值的潜在准确性做出错误假设，从而存在漏洞。建议构建低级别 HTTP 实用工具的 Node.js 用户在解析完成后，重新检查所提供的任何输入的长度。
    (CVE-2018-7159)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2019:2258 公告中提及的多个漏洞的影响。

  - nodejs：HTTP 解析器允许 Content-Length 标头值内的空格 (CVE-2018-7159)

  - nodejs：具有大型 HTTP 标头拒绝服务 (CVE-2018-12121)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
118933	Node.js multiple vulnerabilities (March 2018 Security Releases).	Nessus	Misc.	2018/11/14	2024/1/9	high
180827	Oracle Linux 7 : http-parser (ELSA-2019-2258)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	medium
127700	RHEL 7 : http-parser (RHSA-2019:2258)	Nessus	Red Hat Local Security Checks	2019/8/12	2024/11/6	medium
128222	Scientific Linux Security Update : http-parser on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	2019/8/27	2020/2/24	medium
109717	openSUSE Security Update : nodejs6 (openSUSE-2018-444)	Nessus	SuSE Local Security Checks	2018/5/11	2024/10/9	high
129307	F5 网络 BIG-IP：Node.js 漏洞 (K27228191)	Nessus	F5 Networks Local Security Checks	2019/9/25	2023/11/3	medium
118933	Node.js 多个漏洞（2018 年 3 月安全版本）。	Nessus	Misc.	2018/11/14	2024/1/9	high
128222	Scientific Linux 安全更新：SL7.x x86_64 上的 http-parser	Nessus	Scientific Linux Local Security Checks	2019/8/27	2020/2/24	medium
180827	Oracle Linux 7：http-parser (ELSA-2019-2258)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	medium
127700	RHEL 7：http-parser (RHSA-2019:2258)	Nessus	Red Hat Local Security Checks	2019/8/12	2024/11/6	medium

检测

插件搜索

high

medium

medium

medium

high

medium

high

medium

medium

medium