PT-2019-17837 · Node.Js+2 · Node.Js+2

Timur Shemsedinov · Published 2018-05-25 · Updated 2020-10-16 · CVE-2019-5739

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 6.17.0

Description The issue allows HTTP and HTTPS connections to remain open and inactive for an extended period, which can be exploited as a potential Denial of Service (DoS) attack vector. This behavior is due to the lack of a dedicated timeout setting in affected versions. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For Node.js versions prior to 6.17.0, consider introducing a timeout setting, such as server.keepAliveTimeout, to mitigate the risk of Denial of Service (DoS) attacks, ideally setting it to a default of 5 seconds as introduced in later versions.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

ALT-PU-2018-1807

CVE-2019-5739

MGASA-2019-0277

OPENSUSE-SU-2019_1076-1

OPENSUSE-SU-2019_1173-1

SUSE-SU-2019:0658-1

SUSE-SU-2019:0818-1

Affected Products

Alt Linux

Node.Js

Suse

References · 55

• https://security-tracker.debian.org/tracker/CVE-2019-5739 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0277 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0818-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0658-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-5739 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-5739 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-5739 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5739 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html · Vendor Advisory
• https://security.gentoo.org/glsa/202003-48 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12120 · Security Note
• https://nodejs.org/en/blog/vulnerability/february-2019-security-releases · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-1807 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-5739 · Vendor Advisory