Red Hat Security AdvisoryRHSA-2020:4903
nodejs:12 security and bug fix update
Released 2020-11-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12, nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12, nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12 +19
Fixes 4 records
Priority MEDIUM 41
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.05299 · Published 2020-09-18 · Partial fix · 12.18.4, 14.11.0 CWE-444
Priority LOW 38
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.03079 · Published 2020-02-04 · Partial fix · 4.2.1, 5.1.1 CWE-471
Priority LOW 35
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00714 · Published 2020-09-18 · Partial fix · 10.22.1, 12.18.4 +1 CWE-120
Priority LOW 21
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files.
CVSS 3.1MEDIUM 4.4· Local · Low privileges · User interaction · EPSS 0.00404 · Published 2020-07-07 · Partial fix · 6.14.6 CWE-532
THREATIST.IORead the docs