Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js 6.17.0 (LTS)

Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.

Announced

Node.js · Fixed in 6.17.0OpenSSL · Fixed in 1.0.2rCVE-2019-5739CVE-2019-5737CVE-2019-1559
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. All Node.js users should consult the security release summary

Node.js

Node.js 6.17.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
6.17.0
Node.js 6.17.0 (LTS)
Prerequisites
Not stated in this extraction

OpenSSL

OpenSSL: 0-byte record padding oracle (CVE-2019-1559)
Affected versions
Not stated in this extraction
Fixed versions
1.0.2r
OpenSSL has been upgraded to 1.0.2r
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2019-5739
CVE-2019-5739
CVE-2019-5737
CVE-2019-5737
CVE-2019-1559
CVE-2019-1559

Publisher severity

No explicit severity was extracted.

Event
#51190 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

February 2019 Security Releases

Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.

Announced

Node.js · Fixed in Node.js 11.10.1, Node.js 10.15.2, Node.js 8.15.1, Node.js 6.17.0OpenSSL · Fixed in OpenSSL 1.0.2rCVE-2019-5737CVE-2019-5739CVE-2019-1559
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for all active Node.js release lines.

Node.js

Node.js 11.10.1 (Current)
Affected versions
All versions of Node.js 6 (LTS "Boron")
All versions of Node.js 6 (LTS "Boron") are vulnerable
All versions of Node.js 8 (LTS "Carbon")
All versions of Node.js 8 (LTS "Carbon") are vulnerable
All versions of Node.js 10 (LTS "Dubnium")
All versions of Node.js 10 (LTS "Dubnium") are vulnerable
All versions of Node.js 11 (Current)
All versions of Node.js 11 (Current) are vulnerable
Fixed versions
Node.js 11.10.1
Node.js 11.10.1 (Current)
Node.js 10.15.2
Node.js 10.15.2 (LTS "Dubnium")
Node.js 8.15.1
Node.js 8.15.1 (LTS "Carbon")
Node.js 6.17.0
Node.js 6.17.0 (LTS "Boron")
Prerequisites
Not stated in this extraction

OpenSSL

OpenSSL 1.0.2r contains a fix for CVE-2019-1559
Affected versions
OpenSSL 1.0.2
The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2
Fixed versions
OpenSSL 1.0.2r
OpenSSL 1.0.2r contains a fix for CVE-2019-1559
Prerequisites
included in the releases for Node.js versions 6 and 8 only
OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only.
Related CVEs
CVE-2019-5737
Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)
CVE-2019-5739
Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)
CVE-2019-1559
OpenSSL 1.0.2r contains a fix for CVE-2019-1559

Publisher severity

No explicit severity was extracted.

Event
#50634 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement