Red Hat Security AdvisoryRHSA-2021:0735
nodejs:10 security update
Released 2021-03-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.24.0-1.module+el8.3.0+10166+b07ac28e.aarch64::nodejs:10, nodejs-1:10.24.0-1.module+el8.3.0+10166+b07ac28e.ppc64le::nodejs:10, nodejs-1:10.24.0-1.module+el8.3.0+10166+b07ac28e.s390x::nodejs:10 +19
Fixes 2 records
Priority HIGH 72
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.77385 · Published 2021-03-03 · Partial fix · 10.24.0, 12.21.0 +2 CWE-400
Priority MEDIUM 59
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.36842 · Published 2021-03-03 · Partial fix · 10.24.0, 12.21.0 +2 CWE-350
