CVE-2019-9514
Description
Important: nodejs:10 security update
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2019-2925.html
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2019-4269.html
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2019-4273.html
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2019:2925
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2019:4269
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2019:4273
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2019-9514
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2019-9514.html
Vendor advisory: arch — https://security.archlinux.org/ASA-201908-15
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| arch | fixed | 2:1.12.8-1 | |
| sles | affected | | |
| debian | bookworm | fixed | 2.2.5+dfsg2-3 |
| debian | bullseye | fixed | 2.2.5+dfsg2-3 |
| rocky | 8 | fixed | |
| debian | forky | fixed | 10.16.3~dfsg-1 |
| debian | sid | fixed | 10.16.3~dfsg-1 |
| debian | trixie | fixed | 10.16.3~dfsg-1 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | golang.org/x/net | <0.0.0-20190813141303-74dc4d7220e7 | 0.0.0-20190813141303-74dc4d7220e7 |
| Go | stdlib | >=1.12.0-0,<1.12.8 | 1.11.13 |
References
- https://security.archlinux.org/ASA-201908-15
- https://www.suse.com/security/cve/CVE-2019-9514.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-9514
- https://access.redhat.com/errata/RHSA-2019:2594
- https://go.dev/cl/190137
- https://go.dev/issue/33606
- https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5
- https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ
- https://kb.cert.org/vuls/id/605641
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E
- https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E
- https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ
- https://pkg.go.dev/vuln/GO-2022-0536
- https://seclists.org/bugtraq/2019/Aug/24
- https://seclists.org/bugtraq/2019/Aug/31
- https://seclists.org/bugtraq/2019/Aug/43
- https://seclists.org/bugtraq/2019/Sep/18
- https://security.netapp.com/advisory/ntap-20190823-0001
- https://security.netapp.com/advisory/ntap-20190823-0004
Verify integrity in audit chain (admin only). AS-IS.