| Description: | Summary:
The remote host is missing an update for the 'nodejs10' package(s) announced via the SUSE-SU-2019:2254-1 advisory.
Vulnerability Insight:
This update for nodejs10 to version 10.16.3 fixes the following issues:
Security issues fixed:
CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to
window size manipulation and stream prioritization manipulation,
potentially leading to a denial of service (bsc#1146091).
CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded
memory growth (bsc#1146099).
CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to
resource loops, potentially leading to a denial of service.
(bsc#1146094).
CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset
flood, potentially leading to a denial of service (bsc#1146095).
CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in
unbounded memory growth (bsc#1146100).
CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a
header leak, potentially leading to a denial of service (bsc#1146090).
CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to
unconstrained interal data buffering (bsc#1146097).
CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood
of empty frames, potentially leading to a denial of service
(bsc#1146093).
Affected Software/OS:
'nodejs10' package(s) on SUSE Linux Enterprise Module for Web Scripting 12.
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
