Summary
[2.7.1-8]
- Backport needed test fixes
- Related: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
allowed for spaces inside Content-Length header
values [rhel-7]
[2.7.1-7]
- Resolves: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
allowed for spaces inside Content-Length header
values [rhel-7]
[2.7.1-6]
- Resolves: rhbz#1666381 - CVE-2018-12121 http-parser: nodejs: Denial of
Service with large HTTP headers [rhel-7]
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | http-parser | 0:2.7.1-8.el7 |
| Oracle Linux · 7 | http-parser-devel | 0:2.7.1-8.el7 |
Vulnerabilities 2
-
Unscored —CVE-2018-12121 EPSS 10%
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: B…
-
Unscored —
The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such a…