CVE-2019-15604

Published: Feb 7, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

Affected (20)

Products: Nodejs: Node.js · Debian: Debian Linux · Opensuse: Leap · +2 more

Show all products

Nodejs: Node.js · Debian: Debian Linux · Opensuse: Leap · Redhat: Enterprise Linux, Enterprise Linux Eus, Enterprise Linux Server Aus, Enterprise Linux Server Tus, Software Collections · Oracle: Communications Cloud Native Core Network Function Cloud Native Environment, Graalvm

1 product

1 product

1 product

5 products

Enterprise Linux

Enterprise Linux Eus

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Software Collections

2 products

Communications Cloud Native Core Network Function Cloud Native Environment

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 13.0.0 to 13.8.0
Nodejs Node.js	From 10.0.0 to 10.19.0
Nodejs Node.js	From 12.0.0 to 12.15.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

Configuration D

12 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Eus	Version 8.1
Redhat Enterprise Linux Eus	Version 8.2
Redhat Enterprise Linux Eus	Version 8.4
Redhat Enterprise Linux Eus	Version 8.6
Redhat Enterprise Linux Server Aus	Version 8.2
Redhat Enterprise Linux Server Aus	Version 8.4
Redhat Enterprise Linux Server Aus	Version 8.6
Redhat Enterprise Linux Server Tus	Version 8.2
Redhat Enterprise Linux Server Tus	Version 8.4
Redhat Enterprise Linux Server Tus	Version 8.6
Redhat Software Collections	Version 1.0

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Version 1.4.0
Oracle Graalvm	Version 19.3.1
Oracle Graalvm	Version 20.0.0

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (32)

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2020:0573

Source: support@hackerone.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0579

Source: support@hackerone.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0597

Source: support@hackerone.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0598

Source: support@hackerone.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0602

Source: support@hackerone.com

Third Party Advisory

https://hackerone.com/reports/746733

Source: support@hackerone.com

ExploitThird Party Advisory

https://nodejs.org/en/blog/release/v10.19.0/

Source: support@hackerone.com

Release NotesVendor Advisory

https://nodejs.org/en/blog/release/v12.15.0/

Source: support@hackerone.com

Release NotesVendor Advisory

https://nodejs.org/en/blog/release/v13.8.0/

Source: support@hackerone.com

Vendor Advisory

https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/

Source: support@hackerone.com

Vendor Advisory

https://security.gentoo.org/glsa/202003-48

Source: support@hackerone.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200221-0004/

Source: support@hackerone.com

Third Party Advisory

https://www.debian.org/security/2020/dsa-4669

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: support@hackerone.com

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2020:0573

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0579

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0597

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0598

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0602

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://hackerone.com/reports/746733

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://nodejs.org/en/blog/release/v10.19.0/

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://nodejs.org/en/blog/release/v12.15.0/

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://nodejs.org/en/blog/release/v13.8.0/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://security.gentoo.org/glsa/202003-48

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200221-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4669

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.