Issued:
2016-10-27
Updated:
2016-10-27

RHSA-2016:2101 - Moderate: nodejs and nodejs-tough-cookie security, bug fix, and enhancement update

Synopsis

Moderate: nodejs and nodejs-tough-cookie security, bug fix, and enhancement update

Type/Severity

Security Advisory Moderate

Topic

An update for nodejs-tough-cookie and nodejs is now available for Red Hat OpenShift Container Platform 3.1, 3.2, and 3.3.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

Security Fix(es):

  • A regular expression denial of service flaw was found in Tough-Cookie. An attacker able to make an application using Touch-Cookie to parse a sufficiently large HTTP request Cookie header could cause the application to consume an excessive amount of CPU. (CVE-2016-1000232)

  • It was found that the reason argument in ServerResponse#writeHead() was not properly validated. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted HTTP request. (CVE-2016-5325)

This advisory contains the RPM packages for this release. See the following advisory for the container images fixes for this release:

https://access.redhat.com/errata/RHBA-2016:2100

Solution

For details on how to apply this update in OpenShift Container Platform 3, see the Solution section of the following advisory:

https://access.redhat.com/errata/RHBA-2016:2100

Affected Products

ProductVersionArch
Red Hat OpenShift Container Platform3.3x86_64
Red Hat OpenShift Container Platform3.2x86_64
Red Hat OpenShift Container Platform3.1x86_64

Updated Packages

  • nodejs-tough-cookie-2.3.1-1.el7.noarch.rpm
  • nodejs-tough-cookie-2.3.1-1.el7.src.rpm
  • nodejs-0.10.47-2.el7.src.rpm
  • nodejs-debuginfo-0.10.47-2.el7.x86_64.rpm
  • nodejs-docs-0.10.47-2.el7.noarch.rpm
  • nodejs-0.10.47-2.el7.x86_64.rpm
  • nodejs-devel-0.10.47-2.el7.x86_64.rpm

Fixes

CVEs

References

Additional information