Red Hat Security Advisory

RHSA-2021:0485

rh-nodejs12-nodejs security update

Released 2021-02-11 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2

Fixes 7 records

TI-2020-06304 CVE-2020-7788 · GHSA-qqgx-2p2h-9c37

Prototype pollution in ini

MEDIUM 55

This affects the package ini before 1.3.6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03655 Published 2020-12-11 Partial fix · 1.3.6 CWE-1321

TI-2019-08011 CVE-2019-10746 · GHSA-fhjf-83wg-r2j9

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version…

MEDIUM 48

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03651 Published 2019-08-23 Partial fix · 1.3.2, 2.0.1 CWE-88

TI-2020-06683 CVE-2020-8265 · GHSA-879w-9vpf-9pw9

Use after free in NodeJS Node

MEDIUM 47

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.09116 Published 2021-01-06 Fixed in 10.23.1, 12.20.1 +2 CWE-416

TI-2019-08012 CVE-2019-10747 · GHSA-4g88-fppr-53pp

Uncontrolled resource consumption in set-value

MEDIUM 47

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02475 Published 2019-08-23 Partial fix · 2.0.1, 3.0.1 CWE-400

TI-2018-02746 CVE-2018-3750 · GHSA-hr2v-3952-633q

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be…

MEDIUM 46

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02147 Published 2018-07-03 Partial fix · 0.5.1 CWE-20

TI-2020-06704 CVE-2020-8287 · GHSA-f33f-hhx9-6j4m

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header…

MEDIUM 45

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.16296 Published 2021-01-06 Fixed in 10.23.1, 12.20.1 +2 CWE-444

TI-2020-06272 CVE-2020-7754 · GHSA-pw54-mh39-w3hc

Regular expression denial of service (ReDoS) in npm-user-validate

LOW 39

This affects the package npm-user-validate before 1.0.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03481 Published 2020-10-27 Partial fix · 1.0.1 CWE-400