Red Hat Security Advisory

RHSA-2020:3084

rh-nodejs10-nodejs security update

Released 2020-07-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1

TI-2020-06592 CVE-2020-8174 · GHSA-gcvv-7whm-pv7c

MEDIUM 46

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.07646 Published 2020-07-24 Partial fix CWE-119

TI-2020-08454 CVE-2020-10531 · GHSA-8xp2-qvq2-xhpx

MEDIUM 43

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02669 Published 2020-03-12 Partial fix CWE-190

TI-2020-08954 CVE-2020-11080

MEDIUM 41

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05316 Published 2020-06-03 Fixed in 1.41.0 CWE-707

TI-2020-06120 CVE-2020-7598 · GHSA-vh95-rmgr-6w4m

LOW 35

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.01931 Published 2020-03-11 Partial fix · 0.2.1, 1.2.3 CWE-1321