Linux · Security advisory · September 30, 2019
RHSA-2019:2925: Security update for 6 packages
RHSA-2019:2925, released September 30, 2019, fixes 9 CVEs across 6 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
9
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.8729
99th percentile
Priority of the 9 CVEs
Patch now 0
Urgent 0
High 9
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| nodejs | RHEL 8 | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| nodejs-devel | RHEL 8 | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| nodejs-docs | RHEL 8 | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| nodejs-nodemon | RHEL 8 | 0:1.18.3-1.module+el8+2632+6c5111ed |
| nodejs-packaging | RHEL 8 | 0:17-3.module+el8+2873+aa7dfd9a |
| npm | RHEL 8 | 1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2019-9515 | python3-twisted: Some HTTP/2 implementations are vulnerable to a settings flood, potentiallyleading to a denial of service | 7.5 | 0.8729 | None reported | |
| High | CVE-2019-9512 | HTTP/2 Server Denial of Service Vulnerability | 7.5 | 0.8343 | Exploitation Less Likely | |
| High | CVE-2019-9514 | HTTP/2 Server Denial of Service Vulnerability | 7.5 | 0.8281 | Exploitation Less Likely | |
| High | CVE-2019-9513 | HTTP/2 Server Denial of Service Vulnerability | 7.5 | 0.8156 | Exploitation Less Likely | |
| High | CVE-2019-9511 | HTTP/2 Server Denial of Service Vulnerability | 7.5 | 0.5955 | Exploitation Less Likely | |
| High | CVE-2019-9516 | nginx-mod-http-perl: Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 (Post Office Protocol 3) and IMAP protocols, wi... | 7.5 | 0.5746 | None reported | |
| High | CVE-2019-9517 | mod_session: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... | 7.5 | 0.2700 | None reported | |
| High | CVE-2019-9518 | HTTP/2 Server Denial of Service Vulnerability | 7.5 | 0.2545 | Exploitation Less Likely | |
| High | CVE-2019-5737 | Node.js 6 and 1 other: Uncontrolled Resource Consumption / Denial of Service | 7.5 | 0.1618 | None reported |
Showing 1 to 9 of 9
1