CVE-2018-12122

Name
CVE-2018-12122
Description
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
Third Party Advisory http://www.securityfocus.com/bid/106043
REDHAT https://access.redhat.com/errata/RHSA-2019:1821
GENTOO https://security.gentoo.org/glsa/202003-48
af854a3a-2127-422b-91ae-364da2661108 https://security.netapp.com/advisory/ntap-20241213-0009/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* nodejs >= 10.0.0 <= 10.14.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* nodejs >= 8.0.0 <= 8.14.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* nodejs >= 6.0.0 <= 6.15.0
cpe:2.3:a:joyent:node.js:*:*:*:*:*:*:*:* node.js >= 11.0.0 <= 11.3.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* nodejs >= 6.0.0 < 6.15.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 11.0.0 < 11.3.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nodejs-current edge-community 11.3.0-r0 None fixed
nodejs-current 3.22-community 11.3.0-r0 None fixed
nodejs-current 3.21-community 11.3.0-r0 None fixed
nodejs-current 3.20-community 11.3.0-r0 None fixed
nodejs-current 3.19-community 11.3.0-r0 None fixed
nodejs-current 3.18-community 11.3.0-r0 None fixed
nodejs-current 3.17-community 11.3.0-r0 None fixed
nodejs edge-main 10.14.0-r0 None fixed
nodejs edge-main 8.11.4-r0 None possibly vulnerable
nodejs edge-main 8.11.3-r0 None possibly vulnerable
nodejs edge-main 8.11.0-r0 None possibly vulnerable
nodejs edge-main 8.9.3-r0 None possibly vulnerable
nodejs edge-main 6.11.5-r0 None possibly vulnerable
nodejs edge-main 6.11.1-r0 None possibly vulnerable
nodejs 3.22-main 10.14.0-r0 None fixed
nodejs 3.22-main 8.11.4-r0 None possibly vulnerable
nodejs 3.22-main 8.11.3-r0 None possibly vulnerable
nodejs 3.22-main 8.11.0-r0 None possibly vulnerable
nodejs 3.22-main 8.9.3-r0 None possibly vulnerable
nodejs 3.22-main 6.11.5-r0 None possibly vulnerable
nodejs 3.22-main 6.11.1-r0 None possibly vulnerable
nodejs 3.21-main 10.14.0-r0 None fixed
nodejs 3.21-main 8.11.4-r0 None possibly vulnerable
nodejs 3.21-main 8.11.3-r0 None possibly vulnerable
nodejs 3.21-main 8.11.0-r0 None possibly vulnerable
nodejs 3.21-main 8.9.3-r0 None possibly vulnerable
nodejs 3.21-main 6.11.5-r0 None possibly vulnerable
nodejs 3.21-main 6.11.1-r0 None possibly vulnerable
nodejs 3.20-main 10.14.0-r0 None fixed
nodejs 3.20-main 8.11.4-r0 None possibly vulnerable
nodejs 3.20-main 8.11.3-r0 None possibly vulnerable
nodejs 3.20-main 8.11.0-r0 None possibly vulnerable
nodejs 3.20-main 8.9.3-r0 None possibly vulnerable
nodejs 3.20-main 6.11.5-r0 None possibly vulnerable
nodejs 3.20-main 6.11.1-r0 None possibly vulnerable
nodejs 3.19-main 10.14.0-r0 None fixed
nodejs 3.19-main 8.11.4-r0 None possibly vulnerable
nodejs 3.19-main 8.11.3-r0 None possibly vulnerable
nodejs 3.19-main 8.11.0-r0 None possibly vulnerable
nodejs 3.19-main 8.9.3-r0 None possibly vulnerable
nodejs 3.19-main 6.11.5-r0 None possibly vulnerable
nodejs 3.19-main 6.11.1-r0 None possibly vulnerable
nodejs 3.18-main 10.14.0-r0 None fixed
nodejs 3.17-main 10.14.0-r0 None fixed
nodejs 3.12-main 10.14.0-r0 None fixed
nodejs 3.11-main 10.14.0-r0 None fixed
nodejs 3.10-main 10.14.0-r0 None fixed