[Git][security-tracker-team/security-tracker][master] nodejs also affected by HTTP2 issues

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
593b866d by Moritz Muehlenhoff at 2019-08-16T07:31:48Z
nodejs also affected by HTTP2 issues
add golang and nodejs to dsa-needed

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -16993,17 +16993,33 @@ CVE-2019-9520
 CVE-2019-9519
 	RESERVED
 CVE-2019-9518 (Some HTTP/2 implementations are vulnerable to a flood of empty frames, ...)
-	TODO: check
+	- nodejs <unfixed>
+	[stretch] - nodejs <not-affected> (No HTTP2 support yet)
+	[jessie] - nodejs <not-affected> (No HTTP2 support yet)
+	NOTE: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
+	NOTE: https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
 CVE-2019-9517 (Some HTTP/2 implementations are vulnerable to unconstrained interal da ...)
 	- apache2 2.4.41-1
+	- nodejs <unfixed>
+	[stretch] - nodejs <not-affected> (No HTTP2 support yet)
+	[jessie] - nodejs <not-affected> (No HTTP2 support yet)
 	NOTE: Affects upstream versions 2.4.20 to 2.4.39
 	NOTE: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
+	NOTE: https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
 CVE-2019-9516 (Some HTTP/2 implementations are vulnerable to a header leak, potential ...)
+	- nodejs <unfixed>
+	[stretch] - nodejs <not-affected> (No HTTP2 support yet)
+	[jessie] - nodejs <not-affected> (No HTTP2 support yet)
 	- nginx <unfixed>
 	NOTE: https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
-	TODO: check for more
+	NOTE: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
+	NOTE: https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
 CVE-2019-9515 (Some HTTP/2 implementations are vulnerable to a settings flood, potent ...)
-	TODO: check
+	- nodejs <unfixed>
+	[stretch] - nodejs <not-affected> (No HTTP2 support yet)
+	[jessie] - nodejs <not-affected> (No HTTP2 support yet)
+	NOTE: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
+	NOTE: https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
 CVE-2019-9514 (Some HTTP/2 implementations are vulnerable to a reset flood, potential ...)
 	- golang-1.13 <unfixed>
 	- golang-1.12 1.12.8-1
@@ -17012,13 +17028,22 @@ CVE-2019-9514 (Some HTTP/2 implementations are vulnerable to a reset flood, pote
 	- golang-1.7 <removed>
 	- golang <removed>
 	- golang-golang-x-net-dev <unfixed>
+	- nodejs <unfixed>
+	[stretch] - nodejs <not-affected> (No HTTP2 support yet)
+	[jessie] - nodejs <not-affected> (No HTTP2 support yet)
 	NOTE: Issue: https://github.com/golang/go/issues/33606
 	NOTE: https://github.com/golang/go/commit/e152b01a468a1c18a290bf9aec52ccea7693c7f2 (golang-1.11)
 	NOTE: https://github.com/golang/go/commit/7139b45d1410ded14e1e131151fd8dfc435ede6c (golang-1.12)
+	NOTE: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
+	NOTE: https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
 CVE-2019-9513 (Some HTTP/2 implementations are vulnerable to resource loops, potentia ...)
 	- nginx <unfixed>
+	- nodejs <unfixed>
+	[stretch] - nodejs <not-affected> (No HTTP2 support yet)
+	[jessie] - nodejs <not-affected> (No HTTP2 support yet)
 	NOTE: https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
-	TODO: check for more
+	NOTE: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
+	NOTE: https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
 CVE-2019-9512 (Some HTTP/2 implementations are vulnerable to ping floods, potentially ...)
 	- golang-1.13 <unfixed>
 	- golang-1.12 1.12.8-1
@@ -17027,13 +17052,22 @@ CVE-2019-9512 (Some HTTP/2 implementations are vulnerable to ping floods, potent
 	- golang-1.7 <removed>
 	- golang <removed>
 	- golang-golang-x-net-dev <unfixed>
+	- nodejs <unfixed>
+	[stretch] - nodejs <not-affected> (No HTTP2 support yet)
+	[jessie] - nodejs <not-affected> (No HTTP2 support yet)
 	NOTE: Issue: https://github.com/golang/go/issues/33606
 	NOTE: https://github.com/golang/go/commit/e152b01a468a1c18a290bf9aec52ccea7693c7f2 (golang-1.11)
 	NOTE: https://github.com/golang/go/commit/7139b45d1410ded14e1e131151fd8dfc435ede6c (golang-1.12)
+	NOTE: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
+	NOTE: https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
 CVE-2019-9511 (Some HTTP/2 implementations are vulnerable to window size manipulation ...)
 	- nginx <unfixed>
+	- nodejs <unfixed>
+	[stretch] - nodejs <not-affected> (No HTTP2 support yet)
+	[jessie] - nodejs <not-affected> (No HTTP2 support yet)
 	NOTE: https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
-	TODO: check for more
+	NOTE: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
+	NOTE: https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
 CVE-2019-9510
 	RESERVED
 CVE-2019-9509


=====================================
data/dsa-needed.txt
=====================================
@@ -26,6 +26,8 @@ freeimage
 --
 glusterfs/oldstable
 --
+golang-1.11 (jmm)
+--
 graphicsmagick/oldstable
 --
 jruby/oldstable
@@ -38,6 +40,8 @@ linux (carnil)
 --
 mercurial/oldstable
 --
+nodejs
+--
 nss (jmm)
   Roberto proposed an update including fixes for CVE-2018-12404 and CVE-2018-18508
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/593b866d7c328bc6f5b45de66983efeb0dce2362

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/593b866d7c328bc6f5b45de66983efeb0dce2362
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190816/8d47d604/attachment.html>