Red Hat Security AdvisoryRHSA-2016:1380
nodejs010-node-gyp and nodejs010-nodejs-qs security and bug fix update
Released 2016-07-05 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) nodejs010-node-gyp-3.2.0-3.el6, nodejs010-nodejs-qs-0.6.5-5.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) nodejs010-node-gyp-3.2.0-3.el7, nodejs010-nodejs-qs-0.6.5-5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) nodejs010-node-gyp-3.2.0-3.el6, nodejs010-nodejs-qs-0.6.5-5.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) nodejs010-node-gyp-3.2.0-3.el6, nodejs010-nodejs-qs-0.6.5-5.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) nodejs010-node-gyp-3.2.0-3.el7, nodejs010-nodejs-qs-0.6.5-5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) nodejs010-node-gyp-3.2.0-3.el7, nodejs010-nodejs-qs-0.6.5-5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) nodejs010-node-gyp-3.2.0-3.el6, nodejs010-nodejs-qs-0.6.5-5.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) nodejs010-node-gyp-3.2.0-3.el7, nodejs010-nodejs-qs-0.6.5-5.el7
Fixes 1 record
Priority LOW 34
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse arr…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.08309 · Published 2014-10-19 · Fixed in 1.0.0 CWE-399
