Linux · Security advisory · September 30, 2019

ELSA-2019-2925: Security update for 6 packages

ELSA-2019-2925, released September 30, 2019, fixes 8 CVEs across 6 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.8729
99th percentile

Priority of the 8 CVEs

Patch now 0 Urgent 0 High 8 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsol 81:10.14.1-1.module+el8.0.0+5349+4d6b561f
nodejs-develol 81:10.14.1-1.module+el8.0.0+5349+4d6b561f
nodejs-docsol 81:10.14.1-1.module+el8.0.0+5349+4d6b561f
nodejs-nodemonol 80:1.18.3-1.module+el8.0.0+5349+4d6b561f
nodejs-packagingol 80:17-3.module+el8.0.0+5349+4d6b561f
npmol 81:6.4.1-1.10.14.1.1.module+el8.0.0+5349+4d6b561f

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2019-9515 python3-twisted: Some HTTP/2 implementations are vulnerable to a settings flood, potentiallyleading to a denial of service 7.5 0.8729 None reported
High CVE-2019-9512 HTTP/2 Server Denial of Service Vulnerability 7.5 0.8343 Exploitation Less Likely
High CVE-2019-9514 HTTP/2 Server Denial of Service Vulnerability 7.5 0.8281 Exploitation Less Likely
High CVE-2019-9513 HTTP/2 Server Denial of Service Vulnerability 7.5 0.8156 Exploitation Less Likely
High CVE-2019-9511 HTTP/2 Server Denial of Service Vulnerability 7.5 0.5955 Exploitation Less Likely
High CVE-2019-9516 nginx-mod-http-perl: Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 (Post Office Protocol 3) and IMAP protocols, wi... 7.5 0.5746 None reported
High CVE-2019-9517 mod_session: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... 7.5 0.2700 None reported
High CVE-2019-9518 HTTP/2 Server Denial of Service Vulnerability 7.5 0.2545 Exploitation Less Likely
Showing 1 to 8 of 8 1