Red Hat Security Advisory

RHSA-2020:5086

rh-nodejs12-nodejs security update

Released 2020-11-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.18.4-3.el7, rh-nodejs12-nodejs-devel-12.18.4-3.el7, rh-nodejs12-nodejs-docs-12.18.4-3.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs12-nodejs-12.18.4-3.el7, rh-nodejs12-nodejs-devel-12.18.4-3.el7, rh-nodejs12-nodejs-docs-12.18.4-3.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.18.4-3.el7, rh-nodejs12-nodejs-devel-12.18.4-3.el7, rh-nodejs12-nodejs-docs-12.18.4-3.el7 +1
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.18.4-3.el7, rh-nodejs12-nodejs-devel-12.18.4-3.el7, rh-nodejs12-nodejs-docs-12.18.4-3.el7 +1

Fixes 4 records

TI-2020-06619 CVE-2020-8201 · GHSA-7mcp-gwc2-4c6m

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver…

MEDIUM 41

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.05299 Published 2020-09-18 Partial fix · 12.18.4, 14.11.0 CWE-444

TI-2020-06534 CVE-2020-8116 · GHSA-ff7x-qrg7-qggm

Prototype pollution in dot-prop

LOW 38

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.03079 Published 2020-02-04 Partial fix · 4.2.1, 5.1.1 CWE-471

TI-2020-06670 CVE-2020-8252 · GHSA-c5r6-cm8r-wgh9

Buffer overflow in NodeJS Node

LOW 35

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00714 Published 2020-09-18 Partial fix · 10.22.1, 12.18.4 +1 CWE-120

TI-2020-11870 CVE-2020-15095 · GHSA-93f3-23rq-pjfp

Sensitive information exposure through logs in npm cli

LOW 21

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files.

CVSS 3.1MEDIUM 4.4 Local Low privileges User interaction EPSS 0.00404 Published 2020-07-07 Partial fix · 6.14.6 CWE-532