High ELSA-2020-0708 1 CVE

Important: http-parser security update (Oracle Linux 8)

Published Mar 6, 2020 · Updated Mar 6, 2020

Ecosystem: Oracle Linux

Summary

[2.8.0-5.2]
- Do not break ABI with CVE-2019-15605 fix

[2.8.0-5.1]
- Resolves: CVE-2019-15605 http-parser: nodejs: HTTP request
smuggling using malformed Transfer-Encoding header

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	http-parser	0:2.8.0-5.el8_1.2

Vulnerabilities 1

Unscored —

CVE-2019-15605 Public exploit EPSS 57%

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Node.js node nodejs nodejs Debian Ubuntu Alpine

Feb 7, 2020