Skip to content

Commit 86a1a86

Browse files
groddTrott
authored andcommitted
fixed: Typo in February 2019 security release text for CVE-2019-5737 (#2573)
1 parent 1ce3c8f commit 86a1a86

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

locale/en/blog/vulnerability/february-2019-security-releases.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,9 @@ _Categorization: Uncontrolled Resource Consumption / Denial of Service ([CWE-400
3232

3333
All actively supported release lines are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly thereby keeping the connection and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer.
3434

35-
This vulnerability is an extension of CVE-2018-12121, addressed in [November, 2018](https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/). The 40 second timeout and its adjustment by `server.headersTimeout` apply to this fix as in CVE-2018-12121.
35+
This vulnerability is an extension of CVE-2018-12122, addressed in [November, 2018](https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/). The 40 second timeout and its adjustment by `server.headersTimeout` apply to this fix as in CVE-2018-12122.
3636

37-
CVE-2018-12121 originally reported by Jan Maybach ([liebdich.com](https://liebdich.com)), keep-alive variant reported by [Marco Pracucci](https://twitter.com/pracucci) ([Voxnest](https://voxnest.com)), fixed by [Matteo Collina](https://twitter.com/matteocollina).
37+
CVE-2018-12122 originally reported by Jan Maybach ([liebdich.com](https://liebdich.com)), keep-alive variant reported by [Marco Pracucci](https://twitter.com/pracucci) ([Voxnest](https://voxnest.com)), fixed by [Matteo Collina](https://twitter.com/matteocollina).
3838

3939
**Impact:**
4040
* All versions of Node.js 6 (LTS "Boron") **are** vulnerable

0 commit comments

Comments
 (0)