ALAS2-2020-1417 — Important: http-parser security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-15605: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed 1800364: CVE-2019-15605 nodejs: HTTP request smuggling using malformed Transfer-Encoding header

Fixed packages 3

Release	Package	Fixed in
Amazon Linux · 2	http-parser	0:2.7.1-8.amzn2.2
Amazon Linux · 2	http-parser-debuginfo	0:2.7.1-8.amzn2.2
Amazon Linux · 2	http-parser-devel	0:2.7.1-8.amzn2.2

Vulnerabilities 1

Unscored —

CVE-2019-15605 Public exploit EPSS 57%

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Node.js node nodejs nodejs Debian Ubuntu Alpine

Feb 7, 2020

References

web
https://alas.aws.amazon.com/cve/html/CVE-2019-15605.html