Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Red Hat: RHSA-2017:3002-01 Moderate: Node.js DoS Mitigation

red hat
Calendar Grey October 23, 2017
Scroller Redhat
Mitigating intermediate risks for rh-nodejs4 through the implementation of enhancements and rectifications aimed at improving node.js efficacy and safeguarding integrity.
An update for rh-nodejs4, rh-nodejs4-node-gyp, and rh-nodejs4-nodejs is now available for Red Hat Software Collections

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.
The following packages have been upgraded to a later upstream version: rh-nodejs4-nodejs (4.8.4). (BZ#1476314)
Security Fix(es):
* It was found that Node.js was using a non-randomized seed when populating hash tables. An attacker, able to supply a large number of inputs, could send specially crafted entries to the Node.js application, maximizing hash collisions to trigger an excessive amount of CPU usage, resulting in a denial of service. (CVE-2017-11499)
Bug Fix(es):
* The /opt/rh/rh-nodejs4/root/usr/share/licenses/ directory was not owned by any package. Consequently, when the rh-nodejs4 collection was uninstalled, the directory was not removed. This bug has been fixed, and the aforementioned directory is correctly removed after uninstalling rh-nodejs4. (BZ#1316626)

Topics%20covered

Topics Covered

security advisory moderate red hat software update bug fix dos node.js

References

https://access.redhat.com/security/cve/CVE-2017-11499 https://access.redhat.com/security/updates/classification#moderate

Package List

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):
Source: rh-nodejs4-2.4-4.el6.src.rpm rh-nodejs4-node-gyp-3.3.1-5.el6.src.rpm rh-nodejs4-nodejs-4.6.2-7.el6.src.rpm
noarch: rh-nodejs4-node-gyp-3.3.1-5.el6.noarch.rpm rh-nodejs4-nodejs-docs-4.6.2-7.el6.noarch.rpm
x86_64: rh-nodejs4-2.4-4.el6.x86_64.rpm rh-nodejs4-nodejs-4.6.2-7.el6.x86_64.rpm rh-nodejs4-nodejs-debuginfo-4.6.2-7.el6.x86_64.rpm rh-nodejs4-nodejs-devel-4.6.2-7.el6.x86_64.rpm rh-nodejs4-runtime-2.4-4.el6.x86_64.rpm rh-nodejs4-scldevel-2.4-4.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):
Source: rh-nodejs4-2.4-4.el6.src.rpm rh-nodejs4-node-gyp-3.3.1-5.el6.src.rpm rh-nodejs4-nodejs-4.6.2-7.el6.src.rpm
noarch: rh-nodejs4-node-gyp-3.3.1-5.el6.noarch.rpm rh-nodejs4-nodejs-docs-4.6.2-7.el6.noarch.rpm
x86_64: rh-nodejs4-2.4-4.el6.x86_64.rpm rh-nodejs4-nodejs-4.6.2-7.el6.x86_64.rpm rh-nodejs4-nodejs-debuginfo-4.6.2-7.el6.x86_64.rpm rh-nodejs4-nodejs-devel-4.6.2-7.el6.x86_64.rpm rh-nodejs4-runtime-2.4-4.el6.x86_64.rpm rh-nodejs4-scldevel-2.4-4.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):
Source: rh-nodejs4-2.4-4.el6.src.rpm rh-nodejs4-node-gyp-3.3.1-5.el6.src.rpm rh-nodejs4-nodejs-4.6.2-7.el6.src.rpm
noarch:

Read the Full Advisory


Advisory ID: RHSA-2017:3002-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2017:3002
Issue date: 2017-10-23

Topic

An update for rh-nodejs4, rh-nodejs4-node-gyp, and rh-nodejs4-nodejs is nowavailable for Red Hat Software Collections.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate red hat software update bug fix dos node.js

Relevant Releases Architectures

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

Bugs Fixed

1316626 - Leftover /opt/rh/rh-nodejs4/root/usr/share/licenses after uninstallation

1475327 - CVE-2017-11499 nodejs: Constant Hashtable Seeds vulnerability

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.