{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-01-19T00:00:00", "descriptions": [{"lang": "en", "value": "Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-04-13T15:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hueniverse/hawk/issues/168"}, {"tags": ["x_refsource_MISC"], "url": "https://nodesecurity.io/advisories/77"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"}, {"name": "[oss-security] 20160219 CVE for nodejs hawk", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/02/20/1"}, {"name": "[oss-security] 20160220 Re: CVE for nodejs hawk", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/02/20/2"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2016-2515", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa", "refsource": "CONFIRM", "url": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa"}, {"name": "https://github.com/hueniverse/hawk/issues/168", "refsource": "CONFIRM", "url": "https://github.com/hueniverse/hawk/issues/168"}, {"name": "https://nodesecurity.io/advisories/77", "refsource": "MISC", "url": "https://nodesecurity.io/advisories/77"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"}, {"name": "[oss-security] 20160219 CVE for nodejs hawk", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/02/20/1"}, {"name": "[oss-security] 20160220 Re: CVE for nodejs hawk", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/02/20/2"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:32:20.711Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/hueniverse/hawk/issues/168"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://nodesecurity.io/advisories/77"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"}, {"name": "[oss-security] 20160219 CVE for nodejs hawk", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/02/20/1"}, {"name": "[oss-security] 20160220 Re: CVE for nodejs hawk", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/02/20/2"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2016-2515", "datePublished": "2016-04-13T16:00:00", "dateReserved": "2016-02-20T00:00:00", "dateUpdated": "2024-08-05T23:32:20.711Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hawk_project:hawk:3.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "EC0104C2-41FF-4883-9C80-4819F2A645DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:hawk_project:hawk:4.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "75046180-A750-47A9-AF24-B25A86CA4ABF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression."}, {"lang": "es", "value": "Hawk en versiones anteriores a 3.1.3 y 4.x en versiones anteriores a 4.1.1 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de CPU o interrupci\u00f3n parcial ) a trav\u00e9s de una (1) cabecera o (2) URI larga que coincide contra una expresi\u00f3n regular incorrecta."}], "id": "CVE-2016-2515", "lastModified": "2016-04-20T15:25:42.977", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-04-13T16:59:13.473", "references": [{"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2016/02/20/1"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2016/02/20/2"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "https://github.com/hueniverse/hawk/issues/168"}, {"source": "secalert@redhat.com", "url": "https://nodesecurity.io/advisories/77"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-399"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "nodejs-hawk: Long headers or URIs can cause minor DoS", "id": "1309721", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1309721"}, "csaw": false, "cvss": {"cvss_base_score": "5.0", "cvss_scoring_vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "status": "draft"}, "details": ["Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression."], "name": "CVE-2016-2515", "package_state": [{"cpe": "cpe:/a:redhat:openshift:3.1", "fix_state": "Under investigation", "package_name": "nodejs-hawk", "product_name": "Red Hat OpenShift Enterprise 3.1"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:2", "fix_state": "Under investigation", "package_name": "nodejs010-nodejs-hawk", "product_name": "Red Hat Software Collections"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:2", "fix_state": "Under investigation", "package_name": "rh-nodejs4-nodejs-hawk", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux"}], "public_date": "2016-01-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2016-2515\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-2515"], "statement": "Red Hat Product Security has rated this issue as having Low security impact. Additionally nodejs-hawk is only present as a BuildRequires dependency in the nodejs-request package, the actual hawk functionality is not used in OpenShift Enterprise 3. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "threat_severity": "Low", "upstream_fix": "nodejs-hawk 3.1.3, nodejs-hawk 4.1.1"}