Red Hat Security AdvisoryRHSA-2021:0827
rh-nodejs10-nodejs security update
Released 2021-03-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs-10.24.0-1.el7, rh-nodejs10-nodejs-devel-10.24.0-1.el7, rh-nodejs10-nodejs-docs-10.24.0-1.el7 +1
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs-10.24.0-1.el7, rh-nodejs10-nodejs-devel-10.24.0-1.el7, rh-nodejs10-nodejs-docs-10.24.0-1.el7 +1
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs-10.24.0-1.el7, rh-nodejs10-nodejs-devel-10.24.0-1.el7, rh-nodejs10-nodejs-docs-10.24.0-1.el7 +1
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs-10.24.0-1.el7, rh-nodejs10-nodejs-devel-10.24.0-1.el7, rh-nodejs10-nodejs-docs-10.24.0-1.el7 +1
Fixes 2 records
Priority HIGH 72
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.77385 · Published 2021-03-03 · Partial fix · 10.24.0, 12.21.0 +2 CWE-400
Priority MEDIUM 59
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.36842 · Published 2021-03-03 · Partial fix · 10.24.0, 12.21.0 +2 CWE-350
