Red Hat Security Advisory

RHSA-2020:2852

nodejs:12 security update

Released 2020-07-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.18.2-1.module+el8.2.0+7233+61d664c1.aarch64::nodejs:12, nodejs-1:12.18.2-1.module+el8.2.0+7233+61d664c1.ppc64le::nodejs:12, nodejs-1:12.18.2-1.module+el8.2.0+7233+61d664c1.s390x::nodejs:12 +19

TI-2020-06592 CVE-2020-8174 · GHSA-gcvv-7whm-pv7c

MEDIUM 46

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.07646 Published 2020-07-24 Partial fix CWE-119

TI-2020-08954 CVE-2020-11080

MEDIUM 41

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05316 Published 2020-06-03 Fixed in 1.41.0 CWE-707

TI-2020-06590 CVE-2020-8172 · GHSA-98vx-jqrx-7mq2

MEDIUM 41

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.06065 Published 2020-06-08 Partial fix CWE-295

TI-2020-06120 CVE-2020-7598 · GHSA-vh95-rmgr-6w4m

LOW 35

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.01931 Published 2020-03-11 Partial fix · 0.2.1, 1.2.3 CWE-1321