CVE-2019-15606
Fixed in a distro release EPSS 20%
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| AlmaLinux:8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2047+b07ac28e |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| Alpine:v3.10 | nodejs | 10.19.0-r0 |
| Alpine:v3.11 | nodejs | 12.15.0-r0 |
| Alpine:v3.12 | nodejs | 12.15.0-r0 |
| Alpine:v3.13 | nodejs | 12.15.0-r0 |
| Alpine:v3.14 | nodejs | 12.15.0-r0 |
| Alpine:v3.15 | nodejs | 12.15.0-r0 |
| Alpine:v3.16 | nodejs | 12.15.0-r0 |
| Alpine:v3.17 | nodejs | 12.15.0-r0 |
| Alpine:v3.18 | nodejs | 12.15.0-r0 |
| Alpine:v3.19 | nodejs | 12.15.0-r0 |
| Alpine:v3.20 | nodejs | 12.15.0-r0 |
| Alpine:v3.21 | nodejs | 12.15.0-r0 |
| Alpine:v3.22 | nodejs | 12.15.0-r0 |
| Alpine:v3.23 | nodejs | 12.15.0-r0 |
| Alpine:v3.24 | nodejs | 12.15.0-r0 |
| Alpine:v3.9 | nodejs | 10.19.0-r0 |
| Debian:10 | nodejs | 10.19.0~dfsg1-1 |
| Debian:12 | nodejs | 10.19.0~dfsg-1 |
| Debian:13 | nodejs | 10.19.0~dfsg-1 |
| Debian:14 | nodejs | 10.19.0~dfsg-1 |
| Red Hat:enterprise_linux:8 | nodejs | 1:12.16.1-1.module+el8.1.0+5811+44509afe |
| Red Hat:enterprise_linux:8 | nodejs | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat:enterprise_linux:8 | nodejs-debuginfo | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat:enterprise_linux:8 | nodejs-debuginfo | 1:12.16.1-1.module+el8.1.0+5811+44509afe |
| Red Hat:enterprise_linux:8 | nodejs-debugsource | 1:12.16.1-1.module+el8.1.0+5811+44509afe |
| Red Hat:enterprise_linux:8 | nodejs-debugsource | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat:enterprise_linux:8 | nodejs-devel | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat:enterprise_linux:8 | nodejs-devel | 1:12.16.1-1.module+el8.1.0+5811+44509afe |
| Red Hat:enterprise_linux:8 | nodejs-devel-debuginfo | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat:enterprise_linux:8 | nodejs-docs | 1:12.16.1-1.module+el8.1.0+5811+44509afe |
| Red Hat:enterprise_linux:8 | nodejs-docs | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat:enterprise_linux:8 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat:enterprise_linux:8 | nodejs-nodemon | 0:1.18.3-1.module+el8+2632+6c5111ed |
| Red Hat:enterprise_linux:8 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat:enterprise_linux:8 | nodejs-packaging | 0:17-3.module+el8+2873+aa7dfd9a |
| Red Hat:enterprise_linux:8 | npm | 1:6.13.4-1.12.16.1.1.module+el8.1.0+5811+44509afe |
| Red Hat:enterprise_linux:8 | npm | 1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c |
| Red Hat:rhel_e4s:8.0 | nodejs | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat:rhel_e4s:8.0 | nodejs-debuginfo | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat:rhel_e4s:8.0 | nodejs-debugsource | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat:rhel_e4s:8.0 | nodejs-devel | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat:rhel_e4s:8.0 | nodejs-devel-debuginfo | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat:rhel_e4s:8.0 | nodejs-docs | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat:rhel_e4s:8.0 | nodejs-nodemon | 0:1.18.3-1.module+el8+2632+6c5111ed |
| Red Hat:rhel_e4s:8.0 | nodejs-packaging | 0:17-3.module+el8+2873+aa7dfd9a |
| Red Hat:rhel_e4s:8.0 | npm | 1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c |
| Red Hat:rhel_software_collections:3 | rh-nodejs10-nodejs | 0:10.19.0-1.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs10-nodejs-debuginfo | 0:10.19.0-1.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs10-nodejs-devel | 0:10.19.0-1.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs10-nodejs-docs | 0:10.19.0-1.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs10-npm | 0:6.13.4-10.19.0.1.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs12-nodejs | 0:12.16.1-1.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs12-nodejs-debuginfo | 0:12.16.1-1.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs12-nodejs-devel | 0:12.16.1-1.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs12-nodejs-docs | 0:12.16.1-1.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs12-npm | 0:6.13.4-12.16.1.1.el7 |
| Rocky Linux:8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
| Rocky Linux:8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | nodejs10 | 10.19.0-1.18.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | nodejs8 | 8.17.0-3.28.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | nodejs10 | 10.19.0-1.18.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | nodejs8 | 8.17.0-3.28.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | nodejs10 | 10.19.0-1.18.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | nodejs12 | 12.15.0-1.6.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | nodejs6 | 6.17.1-11.33.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 | nodejs10 | 10.19.0-1.18.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 | nodejs8 | 8.17.0-3.28.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP1 | nodejs10 | 10.19.0-1.18.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP1 | nodejs8 | 8.17.0-3.28.1 |
| SUSE:Linux Enterprise Server 15-LTSS | nodejs10 | 10.19.0-1.18.1 |
| SUSE:Linux Enterprise Server 15-LTSS | nodejs8 | 8.17.0-3.28.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | nodejs10 | 10.19.0-1.18.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | nodejs8 | 8.17.0-3.28.1 |
| SUSE:OpenStack Cloud 7 | nodejs6 | 6.17.1-11.33.1 |
| SUSE:OpenStack Cloud Crowbar 8 | nodejs6 | 6.17.1-11.33.1 |
| SUSE:OpenStack Cloud Crowbar 9 | nodejs6 | 6.17.1-11.33.1 |
| Ubuntu:20.04:LTS | nodejs | 10.19.0~dfsg-3ubuntu1.1 |
| Ubuntu:Pro:14.04:LTS | nodejs | no fix |
| Ubuntu:Pro:16.04:LTS | nodejs | 4.2.6~dfsg-1ubuntu4.2+esm2 |
| Ubuntu:Pro:18.04:LTS | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm2 |
| openSUSE:Leap 15.1 | nodejs8 | 8.17.0-lp151.2.12.1 |