Bugzilla – Bug 846808
VUL-0: CVE-2013-4450: nodejs: HTTP Pipelining DoS
Last modified: 2018-04-26 14:42:15 UTC
CVE-2013-4450 Under high load of HTTP pipelined requests, nodejs didn't try to slow down the number of incoming requests hence consuming 100% CPU and not being able to handle new connections. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4450 https://bugzilla.redhat.com/show_bug.cgi?id=1021170 https://github.com/joyent/node/issues/6214 https://github.com/joyent/node/blob/085dd30e93da67362f044ad1b3b6b2d997064692/test/simple/test-http-pipeline-flood.js (how to test it)
bugbot adjusting priority
The SWAMPID for this issue is 54863. This issue was rated as low. Please submit fixed packages until 2013-11-25. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Sascha: here are the latest security issues we have.
So the Cloud product is not affected since we only use Node.jS during package build (to compile LESS files). For that, we use version 0.6.3 which is horribly outdated. Studio seems to be using 0.6.8 and I would assume moving to a more recent version is far more reasonable than backporting. Upstream semi-promised to backport the fix to 0.10 and 0.8. Therefore reassigning to jordi. I guess he can also decide (with flavio) the openSUSE maintenance part.
Studio product uses nodejs for precompiling the assets. It does that during the firstboot of the appliance. However, in the latest updates we moved the assets precompilation into the script that creates the tarball because nodejs was only available for x86 architectures. Thus, studio product does not really use nodejs once it is setup and running. However, it remains installed.
So as there is no attacker directed input to nodejs, we can ignore this issue for STUDIO and CLOUD as they are not a generic provider of nodejs. opensuse could get fixes if possible.
Created attachment 569976 [details] patch for v0.10.x
Created attachment 569979 [details] patch for v0.8.x
This is an autogenerated message for OBS integration: This bug (846808) was mentioned in https://build.opensuse.org/request/show/209268 12.2 / nodejs https://build.opensuse.org/request/show/209269 12.3 / nodejs https://build.opensuse.org/request/show/209272 13.1 / nodejs
update is running, as its opensuse, I can close the bug now.
openSUSE-SU-2013:1863-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 846808 CVE References: CVE-2013-4450 Sources used: openSUSE 13.1 (src): nodejs-0.10.5-3.4.1 openSUSE 12.3 (src): nodejs-0.8.12-3.4.1 openSUSE 12.2 (src): nodejs-0.6.19-1.8.1