Red Hat Security Advisory

RHSA-2018:2552

Red Hat OpenShift Application Runtimes Node.js 8.11.4 security update

Released 2018-08-22 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Application Runtimes Node.js 8 npm-1:5.6.0-1.8.11.4.2.el7, rhoar-nodejs-1:8.11.4-2.el7, rhoar-nodejs-docs-1:8.11.4-2.el7

Fixes 2 records

TI-2018-00680 CVE-2018-0732 · GHSA-497c-86pp-222m

Client DoS due to large DH parameter

HIGH 69

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.4701 Published 2018-06-12 Partial fix CWE-320

TI-2018-08691 CVE-2018-12115 · GHSA-q85m-543x-pwpc

Out-of-bounds write in NodeJS Node.js

MEDIUM 43

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to wri…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.07779 Published 2018-08-21 Partial fix CWE-787