CVE-2019-15605: Node.js is vulnerable to request smuggling

Severity

Critical

Vendor

Cloud Foundry Foundation

Description

Cloud Foundry Node.js Buildpack, versions prior to 1.7.11, defaults to a version of Node.js that is vulnerable to HTTP request smuggling, which allows malicious payload delivery to unsuspecting users.

Affected Cloud Foundry Products and Versions

Severity is critical unless otherwise noted.

• Node.js Buildpack
  • All versions prior to v1.7.11
• CF Deployment
  • All versions prior to v12.36.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• Node.js Buildpack
  • Upgrade All versions to v1.7.11 or greater
• CF Deployment
  • Upgrade All versions to v12.36.0 or greater

History

2020-03-09: Initial vulnerability report published.