Red Hat Security Advisory: Red Hat OpenShift Application Runtimes Node.js 8.11.4 security update

Fixed packages 4

Vulnerabilities 2

• Unscored —
  CVE-2018-0732 EPSS 47%

  Client DoS due to large DH parameter

  During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a …

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  Jun 12, 2018
• Unscored —
  CVE-2018-12115

  In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js unde…

  The Node.js Project Node.js nodejs nodejs Debian Ubuntu Alpine
  Aug 21, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html-single/red_hat_openshift_application_runtimes_release_notes/index#runtime_components_nodejs_rpm_packages
• article
  https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1591100
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1620219
• article
  https://issues.redhat.com/browse/NODE-153
• article
  https://issues.redhat.com/browse/NODE-154
• article
  https://issues.redhat.com/browse/NODE-155
• article
  https://issues.redhat.com/browse/NODE-160
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2552.json
• report
  https://access.redhat.com/security/cve/CVE-2018-0732
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-0732
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-0732
• article
  https://www.openssl.org/news/secadv/20180612.txt
• report
  https://access.redhat.com/security/cve/CVE-2018-12115
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12115
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12115