Red Hat Security AdvisoryRHSA-2020:0579
nodejs:10 security update
Released 2020-02-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c.aarch64::nodejs:10, nodejs-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c.ppc64le::nodejs:10, nodejs-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c.s390x::nodejs:10 +15
Fixes 6 records
Priority HIGH 75
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.57132 · Published 2020-02-07 · Fixed in 10.19.0, 12.15.0 +1 CWE-444
Priority MEDIUM 61
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.20041 · Published 2020-02-07 · Fixed in 10.19.0, 12.15.0 +1 CWE-20
Priority MEDIUM 51
Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.19966 · Published 2020-02-07 · Fixed in 10.19.0, 12.15.0 +1 CWE-295
Priority MEDIUM 41
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.03422 · Published 2019-12-13 · Partial fix · 6.13.3 CWE-22
Priority MEDIUM 40
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.
CVSS 3.1HIGH 7.7· Network · Low privileges · User interaction · EPSS 0.03334 · Published 2019-12-13 · Partial fix · 6.13.3 CWE-61
Priority LOW 38
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite.
CVSS 3.1HIGH 7.7· Network · Low privileges · User interaction · EPSS 0.02126 · Published 2019-12-13 · Partial fix · 6.13.4 CWE-22
THREATIST.IORead the docs