Red Hat Security Advisory

RHSA-2020:2849

nodejs:10 security update

Released 2020-07-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs-1:10.21.0-3.module+el8.1.0+7070+fe09e702.aarch64::nodejs:10, nodejs-1:10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le::nodejs:10, nodejs-1:10.21.0-3.module+el8.1.0+7070+fe09e702.s390x::nodejs:10 +19

TI-2020-06592 CVE-2020-8174 · GHSA-gcvv-7whm-pv7c

MEDIUM 46

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.07646 Published 2020-07-24 Partial fix CWE-119

TI-2020-08954 CVE-2020-11080

MEDIUM 41

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05316 Published 2020-06-03 Fixed in 1.41.0 CWE-707

TI-2020-06120 CVE-2020-7598 · GHSA-vh95-rmgr-6w4m

LOW 35

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.01931 Published 2020-03-11 Partial fix · 0.2.1, 1.2.3 CWE-1321