Red Hat Security Advisory

RHSA-2020:0597

rh-nodejs10-nodejs security update

Released 2020-02-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs-10.19.0-1.el7, rh-nodejs10-nodejs-devel-10.19.0-1.el7, rh-nodejs10-nodejs-docs-10.19.0-1.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs10-nodejs-10.19.0-1.el7, rh-nodejs10-nodejs-devel-10.19.0-1.el7, rh-nodejs10-nodejs-docs-10.19.0-1.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs-10.19.0-1.el7, rh-nodejs10-nodejs-devel-10.19.0-1.el7, rh-nodejs10-nodejs-docs-10.19.0-1.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs-10.19.0-1.el7, rh-nodejs10-nodejs-devel-10.19.0-1.el7, rh-nodejs10-nodejs-docs-10.19.0-1.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs-10.19.0-1.el7, rh-nodejs10-nodejs-devel-10.19.0-1.el7, rh-nodejs10-nodejs-docs-10.19.0-1.el7 +1

TI-2019-11704 CVE-2019-15605 · GHSA-rv6p-2q56-m955

HIGH 75

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.57132 Published 2020-02-07 Fixed in 10.19.0, 12.15.0 +1 CWE-444

TI-2019-11705 CVE-2019-15606 · GHSA-3qv8-368w-r69p

MEDIUM 61

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20041 Published 2020-02-07 Fixed in 10.19.0, 12.15.0 +1 CWE-20

TI-2019-11703 CVE-2019-15604 · GHSA-4p8g-wmmc-p9f7

MEDIUM 51

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.19966 Published 2020-02-07 Fixed in 10.19.0, 12.15.0 +1 CWE-295

TI-2019-12556 CVE-2019-16776 · GHSA-x8qc-rrcw-4r46

MEDIUM 41

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.03422 Published 2019-12-13 Partial fix · 6.13.3 CWE-22

TI-2019-12555 CVE-2019-16775 · GHSA-m6cx-g6qm-p2cx

MEDIUM 40

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.03334 Published 2019-12-13 Partial fix · 6.13.3 CWE-61

TI-2019-12557 CVE-2019-16777 · GHSA-4328-8hgf-7wjr

LOW 38

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.02126 Published 2019-12-13 Partial fix · 6.13.4 CWE-22