Threats Tagged 'cve-2024-28182'

Multiple security vulnerabilities have been identified and addressed in the Node.js 20 module for Red Hat Enterprise Linux 8. These include denial of service issues via the fetch() function and CONTINUATION frames, an out-of-bounds read in the c-ares library, HTTP request smuggling via content length obfuscation, and other related flaws. Red Hat has released an important security update to fix these issues. The vulnerabilities affect Node.js as packaged for Red Hat Enterprise Linux 8 and its extended life cycle variants across multiple architectures.

Multiple security vulnerabilities affecting Node.js 18 and related components in Red Hat Enterprise Linux 9 have been addressed in an important security update. The issues include denial of service (DoS) vulnerabilities via CONTINUATION frames and the fetch() function, HTTP request smuggling via content length obfuscation, and an out-of-bounds read in the c-ares library. These vulnerabilities could lead to service disruption or crashes. Red Hat has released updates to fix these issues for various Red Hat Enterprise Linux 9 variants and architectures.

Red Hat has issued a security advisory for the nodejs:18 module addressing multiple vulnerabilities including denial of service (DoS) issues via CONTINUATION frames and the fetch() function, HTTP request smuggling through content length obfuscation, and an out-of-bounds read in the c-ares library. These vulnerabilities affect Red Hat Enterprise Linux 8 variants and related architectures. The advisory rates the security impact as Important and provides updated packages to remediate these issues.

A moderate security advisory from Red Hat addresses multiple vulnerabilities affecting Node.js and related components. The primary issue (CVE-2024-22025) involves the use of the fetch() function to retrieve content from untrusted URLs, which can lead to denial of service. Additional vulnerabilities include a denial of service in nghttp2 (CVE-2024-28182) and an out-of-bounds read in c-ares (CVE-2024-25629). Red Hat has released updates for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions to remediate these issues.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * rh-nodejs14-nodejs: CONTINUATION frames DoS (CVE-2024-27983) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: CONTINUATION frames DoS (CVE-2024-28182,VU#421644.5) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 4 addresses multiple security vulnerabilities affecting components such as curl and httpd. These include issues like usage of disabled protocols, certificate check bypasses with wolfSSL and mbedTLS, HTTP/2 push headers memory leaks, and denial of service (DoS) via CONTINUATION frames in httpd and nghttp2. The update replaces the previous Service Pack 3 and includes bug fixes and enhancements. Red Hat rates the security impact as Moderate. Users should apply the update after backing up their installations.