UnratedFix available
February 2019 Security Releases
Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for all active Node.js release lines.
Node.js
Node.js 11.10.1 (Current)
- Affected versions
- All versions of Node.js 6 (LTS "Boron")
All versions of Node.js 6 (LTS "Boron") are vulnerable
All versions of Node.js 8 (LTS "Carbon")All versions of Node.js 8 (LTS "Carbon") are vulnerable
All versions of Node.js 10 (LTS "Dubnium")All versions of Node.js 10 (LTS "Dubnium") are vulnerable
All versions of Node.js 11 (Current)All versions of Node.js 11 (Current) are vulnerable
- Fixed versions
- Node.js 11.10.1
Node.js 11.10.1 (Current)
Node.js 10.15.2Node.js 10.15.2 (LTS "Dubnium")
Node.js 8.15.1Node.js 8.15.1 (LTS "Carbon")
Node.js 6.17.0Node.js 6.17.0 (LTS "Boron")
- Prerequisites
- Not stated in this extraction
OpenSSL
OpenSSL 1.0.2r contains a fix for CVE-2019-1559
- Affected versions
- OpenSSL 1.0.2
The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2
- Fixed versions
- OpenSSL 1.0.2r
OpenSSL 1.0.2r contains a fix for CVE-2019-1559
- Prerequisites
- included in the releases for Node.js versions 6 and 8 only
OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only.
- Related CVEs
- CVE-2019-5737
Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)
CVE-2019-5739Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)
CVE-2019-1559OpenSSL 1.0.2r contains a fix for CVE-2019-1559
Publisher severity
No explicit severity was extracted.
- Event
- #50634 · Revision 1
- Added to Heist Feed
- Publisher date