1. CVE-Search
  2. CVE-2019-15606
ID CVE-2019-15606
Summary Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
References
Vulnerable Configurations
  • cpe:2.3:a:nodejs:node.js:12.0.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.0.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.1.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.1.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.2.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.2.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.3.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.3.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.3.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.3.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.4.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.4.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.5.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.5.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.6.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.6.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.7.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.7.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.8.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.8.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.8.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.8.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.9.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.9.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.9.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.9.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.10.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.10.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.11.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.11.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.11.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.11.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.12.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.12.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.13.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.13.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.13.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.13.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.14.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.14.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:12.14.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:12.14.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.0.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.0.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.1.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.1.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.2.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.2.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.2.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.2.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.3.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.3.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.4.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.4.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.4.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.4.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.5.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.5.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.6.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.6.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.7.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.7.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.8.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.8.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.9.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.9.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.10.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.10.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.11.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.11.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.12.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.12.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.13.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.13.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.14.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.14.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.14.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.14.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.14.2:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.14.2:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.15.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.15.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.15.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.15.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.15.2:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.15.2:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.15.3:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.15.3:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.16.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.16.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.16.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.16.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.16.2:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.16.2:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.16.3:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.16.3:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.17.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.17.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.18.0:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.18.0:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:10.18.1:*:*:*:lts:*:*:*
    cpe:2.3:a:nodejs:node.js:10.18.1:*:*:*:lts:*:*:*
  • cpe:2.3:a:nodejs:node.js:13.0.0:*:*:*:-:*:*:*
    cpe:2.3:a:nodejs:node.js:13.0.0:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:13.0.1:*:*:*:-:*:*:*
    cpe:2.3:a:nodejs:node.js:13.0.1:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:13.1.0:*:*:*:-:*:*:*
    cpe:2.3:a:nodejs:node.js:13.1.0:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:13.2.0:*:*:*:-:*:*:*
    cpe:2.3:a:nodejs:node.js:13.2.0:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:13.3.0:*:*:*:-:*:*:*
    cpe:2.3:a:nodejs:node.js:13.3.0:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:13.4.0:*:*:*:-:*:*:*
    cpe:2.3:a:nodejs:node.js:13.4.0:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:13.5.0:*:*:*:-:*:*:*
    cpe:2.3:a:nodejs:node.js:13.5.0:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:13.6.0:*:*:*:-:*:*:*
    cpe:2.3:a:nodejs:node.js:13.6.0:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:13.7.0:*:*:*:-:*:*:*
    cpe:2.3:a:nodejs:node.js:13.7.0:*:*:*:-:*:*:*
  • cpe:2.3:a:oracle:graalvm:20.0.0:*:*:*:enterprise:*:*:*
    cpe:2.3:a:oracle:graalvm:20.0.0:*:*:*:enterprise:*:*:*
  • cpe:2.3:a:oracle:graalvm:19.3.1:*:*:*:enterprise:*:*:*
    cpe:2.3:a:oracle:graalvm:19.3.1:*:*:*:enterprise:*:*:*
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 07-03-2024 - 21:24)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
redhat via4
advisories
  • bugzilla
    id 1800367
    title CVE-2019-15604 nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 8 is installed
        oval oval:com.redhat.rhba:tst:20193384074
      • comment Module nodejs:12 is enabled
        oval oval:com.redhat.rhea:tst:20200330015
      • OR
        • AND
          • comment nodejs is earlier than 1:12.16.1-1.module+el8.1.0+5811+44509afe
            oval oval:com.redhat.rhsa:tst:20200598001
          • comment nodejs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhea:tst:20200330002
        • AND
          • comment nodejs-debugsource is earlier than 1:12.16.1-1.module+el8.1.0+5811+44509afe
            oval oval:com.redhat.rhsa:tst:20200598003
          • comment nodejs-debugsource is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhea:tst:20200330004
        • AND
          • comment nodejs-devel is earlier than 1:12.16.1-1.module+el8.1.0+5811+44509afe
            oval oval:com.redhat.rhsa:tst:20200598005
          • comment nodejs-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhea:tst:20200330006
        • AND
          • comment nodejs-docs is earlier than 1:12.16.1-1.module+el8.1.0+5811+44509afe
            oval oval:com.redhat.rhsa:tst:20200598007
          • comment nodejs-docs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhea:tst:20200330008
        • AND
          • comment nodejs-nodemon is earlier than 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
            oval oval:com.redhat.rhea:tst:20200330009
          • comment nodejs-nodemon is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhea:tst:20200330010
        • AND
          • comment nodejs-packaging is earlier than 0:17-3.module+el8.1.0+3369+37ae6a45
            oval oval:com.redhat.rhea:tst:20200330011
          • comment nodejs-packaging is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhea:tst:20200330012
        • AND
          • comment npm is earlier than 1:6.13.4-1.12.16.1.1.module+el8.1.0+5811+44509afe
            oval oval:com.redhat.rhsa:tst:20200598013
          • comment npm is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhea:tst:20200330014
    rhsa
    id RHSA-2020:0598
    released 2020-02-25
    severity Important
    title RHSA-2020:0598: nodejs:12 security update (Important)
  • rhsa
    id RHSA-2020:0573
  • rhsa
    id RHSA-2020:0579
  • rhsa
    id RHSA-2020:0597
  • rhsa
    id RHSA-2020:0602
rpms
  • nodejs-1:10.19.0-1.module+el8.0.0+5738+1362a79c
  • nodejs-debuginfo-1:10.19.0-1.module+el8.0.0+5738+1362a79c
  • nodejs-debugsource-1:10.19.0-1.module+el8.0.0+5738+1362a79c
  • nodejs-devel-1:10.19.0-1.module+el8.0.0+5738+1362a79c
  • nodejs-devel-debuginfo-1:10.19.0-1.module+el8.0.0+5738+1362a79c
  • nodejs-docs-1:10.19.0-1.module+el8.0.0+5738+1362a79c
  • nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed
  • nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a
  • npm-1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c
  • nodejs-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
  • nodejs-debuginfo-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
  • nodejs-debugsource-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
  • nodejs-devel-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
  • nodejs-devel-debuginfo-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
  • nodejs-docs-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
  • nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed
  • nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a
  • npm-1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c
  • rh-nodejs10-nodejs-0:10.19.0-1.el7
  • rh-nodejs10-nodejs-debuginfo-0:10.19.0-1.el7
  • rh-nodejs10-nodejs-devel-0:10.19.0-1.el7
  • rh-nodejs10-nodejs-docs-0:10.19.0-1.el7
  • rh-nodejs10-npm-0:6.13.4-10.19.0.1.el7
  • nodejs-1:12.16.1-1.module+el8.1.0+5811+44509afe
  • nodejs-debuginfo-1:12.16.1-1.module+el8.1.0+5811+44509afe
  • nodejs-debugsource-1:12.16.1-1.module+el8.1.0+5811+44509afe
  • nodejs-devel-1:12.16.1-1.module+el8.1.0+5811+44509afe
  • nodejs-docs-1:12.16.1-1.module+el8.1.0+5811+44509afe
  • nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45
  • nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45
  • npm-1:6.13.4-1.12.16.1.1.module+el8.1.0+5811+44509afe
  • rh-nodejs12-nodejs-0:12.16.1-1.el7
  • rh-nodejs12-nodejs-debuginfo-0:12.16.1-1.el7
  • rh-nodejs12-nodejs-devel-0:12.16.1-1.el7
  • rh-nodejs12-nodejs-docs-0:12.16.1-1.el7
  • rh-nodejs12-npm-0:6.13.4-12.16.1.1.el7
refmap via4
confirm
debian DSA-4669
gentoo GLSA-202003-48
misc
suse openSUSE-SU-2020:0293
Last major update 07-03-2024 - 21:24
Published 07-02-2020 - 15:15
Last modified 07-03-2024 - 21:24
Back to Top