Red Hat Security Advisory

RHSA-2020:0598

nodejs:12 security update

Released 2020-02-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.16.1-1.module+el8.1.0+5811+44509afe.aarch64::nodejs:12, nodejs-1:12.16.1-1.module+el8.1.0+5811+44509afe.ppc64le::nodejs:12, nodejs-1:12.16.1-1.module+el8.1.0+5811+44509afe.s390x::nodejs:12 +15

TI-2019-11704 CVE-2019-15605 · GHSA-rv6p-2q56-m955

HIGH 75

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.57132 Published 2020-02-07 Fixed in 10.19.0, 12.15.0 +1 CWE-444

TI-2019-11705 CVE-2019-15606 · GHSA-3qv8-368w-r69p

MEDIUM 61

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20041 Published 2020-02-07 Fixed in 10.19.0, 12.15.0 +1 CWE-20

TI-2019-11703 CVE-2019-15604 · GHSA-4p8g-wmmc-p9f7

MEDIUM 51

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.19966 Published 2020-02-07 Fixed in 10.19.0, 12.15.0 +1 CWE-295