CVE-2019-15604
CVE-2019-15604
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate
CVSS 7.5 · High · EPSS 20.0% · Fix available
- Published
- Updated
Affected products and versions
node.js
- Versions
- ≥ 4.0, < 4.*: Affected (semver)
- ≥ 5.0, < 5.*: Affected (semver)
- ≥ 6.0, < 6.*: Affected (semver)
- ≥ 7.0, < 7.*: Affected (semver)
- ≥ 8.0, < 8.*: Affected (semver)
- ≥ 9.0, < 9.*: Affected (semver)
- ≥ 10.0, < 10.19.0: Affected (semver)
- ≥ 11.0, < 11.*: Affected (semver)
- ≥ 12.0, < 12.15.0: Affected (semver)
- ≥ 13.0, < 13.8.0: Affected (semver)
Update to 10.19.0; Update to 12.15.0; Update to 13.8.0
nodejs Debian:12
- Affected ranges
- ECOSYSTEM: < 10.19.0~dfsg-1
Update to 10.19.0~dfsg-1
nodejs Debian:13
- Affected ranges
- ECOSYSTEM: < 10.19.0~dfsg-1
Update to 10.19.0~dfsg-1
nodejs Debian:14
- Affected ranges
- ECOSYSTEM: < 10.19.0~dfsg-1
Update to 10.19.0~dfsg-1
nodejs Ubuntu:Pro:16.04:LTS
- Versions
- 0.10.25~dfsg2-2ubuntu1
- 4.2.2~dfsg-1
- 4.2.3~dfsg-1
- 4.2.4~dfsg-1ubuntu1
- 4.2.4~dfsg-2
- 4.2.6~dfsg-1ubuntu1
- 4.2.6~dfsg-1ubuntu4
- 4.2.6~dfsg-1ubuntu4.1
- 4.2.6~dfsg-1ubuntu4.2
- 4.2.6~dfsg-1ubuntu4.2+esm1
- Affected ranges
- ECOSYSTEM: < 4.2.6~dfsg-1ubuntu4.2+esm2
Update to 4.2.6~dfsg-1ubuntu4.2+esm2
nodejs Ubuntu:Pro:18.04:LTS
- Versions
- 6.11.4~dfsg-1ubuntu1
- 6.11.4~dfsg-1ubuntu2
- 6.12.0~dfsg-1ubuntu1
- 6.12.0~dfsg-2ubuntu1
- 6.12.0~dfsg-2ubuntu2
- 8.10.0~dfsg-2
- 8.10.0~dfsg-2ubuntu0.2
- 8.10.0~dfsg-2ubuntu0.3
- 8.10.0~dfsg-2ubuntu0.4
- 8.10.0~dfsg-2ubuntu0.4+esm1
- Affected ranges
- ECOSYSTEM: < 8.10.0~dfsg-2ubuntu0.4+esm2
Update to 8.10.0~dfsg-2ubuntu0.4+esm2
Original sources
- https://access.redhat.com/errata/RHSA-2020:0573
- https://access.redhat.com/errata/RHSA-2020:0579
- https://access.redhat.com/errata/RHSA-2020:0597
- https://access.redhat.com/errata/RHSA-2020:0598
- https://access.redhat.com/errata/RHSA-2020:0602
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html
- https://security.gentoo.org/glsa/202003-48
- https://www.debian.org/security/2020/dsa-4669
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://hackerone.com/reports/746733
- https://nodejs.org/en/blog/release/v13.8.0/
- https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/
- https://nodejs.org/en/blog/release/v10.19.0/
- https://nodejs.org/en/blog/release/v12.15.0/
- https://security.netapp.com/advisory/ntap-20200221-0004/
- https://nvd.nist.gov/vuln/detail/CVE-2019-15604