Critical Security Advisory: http-parser Vulnerability in Red Hat Enterprise Linux 8
Summary
RHSA-2019:3497: Red Hat Security Advisory: http-parser security and bug fix update. Affects http-parser versions < 0:2.8.0-5.el8. Fixed in 0:2.8.0-5.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
http-parser is a high-performance, streaming HTTP parser written in C. It is widely used in various applications for parsing HTTP requests and responses. The package is essential for applications that require efficient handling of HTTP traffic. However, it has been identified to contain a vulnerability that could lead to potential security risks, particularly affecting the integrity of the data processed by applications relying on this parser.
Vulnerability Detail
The vulnerability, identified as CVE-2018-12121, originates from a flaw in the http-parser package that could allow an attacker to exploit the parsing mechanism. This could lead to denial of service (DoS) conditions, where the application becomes unresponsive due to malformed HTTP requests. The CVSS score for this vulnerability is 7.5, indicating a high severity level. It is crucial for users of the affected package to address this vulnerability promptly to mitigate potential risks.
How To Fix
Minimum fixed version
0:2.8.0-5.el8
This is the first release that contains the fix.
sudo dnf update http-parserTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation on HTTP requests to filter out potentially malicious data. However, this is not a substitute for applying the patch and should only be used until the update can be applied.
Conclusion
The http-parser vulnerability (CVE-2018-12121) poses a significant risk to applications using this package in Red Hat Enterprise Linux 8. It is essential to update to the patched version to ensure the security and integrity of your applications. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for http-parser →
FAQ
CVE-2018-12121 is a security vulnerability in the http-parser package that can lead to denial of service attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If you cannot update the package immediately, implement input validation on HTTP requests as a temporary workaround.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2019:3497.json.
Related vulnerabilities
Recent vulnerabilities recorded for http-parser.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
