Show plain JSON{"acknowledgement": "Red Hat would like to thank Bartek Nowotarski (nowotarski.info) for reporting this issue.", "affected_release": [{"advisory": "RHSA-2024:2778", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nodejs:20-8090020240422150739.a75119d5", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-05-09T00:00:00Z"}, {"advisory": "RHSA-2024:2780", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nodejs:18-8090020240429131734.a75119d5", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-05-09T00:00:00Z"}, {"advisory": "RHSA-2024:3553", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "nodejs:16-8060020240515105144.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-06-03T00:00:00Z"}, {"advisory": "RHSA-2024:3553", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "nodejs:16-8060020240515105144.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-06-03T00:00:00Z"}, {"advisory": "RHSA-2024:3553", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "nodejs:16-8060020240515105144.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-06-03T00:00:00Z"}, {"advisory": "RHSA-2024:4353", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "nodejs:16-8080020240510090838.63b34585", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-07-08T00:00:00Z"}, {"advisory": "RHSA-2024:4824", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "nodejs:18-8080020240621122004.63b34585", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-07-24T00:00:00Z"}, {"advisory": "RHSA-2024:2779", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "nodejs:18-9040020240422140329.rhel9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-05-09T00:00:00Z"}, {"advisory": "RHSA-2024:2853", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "nodejs:20-9040020240419140200.rhel9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-05-15T00:00:00Z"}, {"advisory": "RHSA-2024:2910", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "nodejs-1:16.20.2-8.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-05-20T00:00:00Z"}, {"advisory": "RHSA-2024:3545", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "nodejs-1:16.20.2-6.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2024-06-03T00:00:00Z"}, {"advisory": "RHSA-2024:2937", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "nodejs-1:16.20.2-5.el9_2.3", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-05-21T00:00:00Z"}, {"advisory": "RHSA-2024:3544", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "nodejs:18-9020020240516091141.rhel9", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-06-03T00:00:00Z"}, {"advisory": "RHSA-2024:3472", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs14-nodejs-0:14.21.3-7.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2024-05-29T00:00:00Z"}], "bugzilla": {"description": "nodejs: CONTINUATION frames DoS", "id": "2272764", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272764"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-400", "details": ["An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.", "A vulnerability was found in how Node.js implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated, remote attacker to send packets to vulnerable servers, which could use up compute or memory resources, causing a denial of service."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2024-27983", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "nodejs:16/nodejs", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2024-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-27983\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27983\nhttps://nodejs.org/en/blog/vulnerability/april-2024-security-releases\nhttps://nowotarski.info/http2-continuation-flood/\nhttps://www.kb.cert.org/vuls/id/421644"], "statement": "Red Hat rates the security impact of this vulnerability as Important due to the worst-case scenario resulting in a denial of service, in alignment with the upstream Node.js project. It is simple to exploit, could significantly impact availability, and there is no reasonable mitigation. Once an attack has ended, the system should return to normal operations on its own.", "threat_severity": "Important"}