Red Hat Security AdvisoryRHSA-2021:3280
rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
Released 2021-08-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
Fixes 10 records
Priority HIGH 68
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.21952 · Published 2021-08-16 · Partial fix · 12.22.5, 14.17.5 +1 CWE-170
Priority HIGH 68
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.36453 · Published 2021-10-07 · Partial fix · 12.22.4, 14.17.4 +1 CWE-416
Priority MEDIUM 55
This affects the package ini before 1.3.6.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03655 · Published 2020-12-11 · Partial fix · 1.3.6 CWE-1321
Priority MEDIUM 51
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization.
CVSS 3.1HIGH 8.2· Local · No auth · User interaction · EPSS 0.15067 · Published 2021-08-03 · Partial fix · 3.2.2, 4.4.14 +2 CWE-22
Priority MEDIUM 48
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.13861 · Published 2021-08-16 · Partial fix · 12.22.5, 14.17.5 +1 CWE-416
Priority MEDIUM 46
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection.
CVSS 3.1HIGH 8.2· Local · No auth · User interaction · EPSS 0.07795 · Published 2021-08-03 · Partial fix · 3.2.3, 4.4.15 +2 CWE-22
Priority MEDIUM 40
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.1473 · Published 2021-08-16 · Partial fix · 12.22.5, 14.17.5 +1 CWE-295
Priority MEDIUM 40
This affects the package glob-parent before 5.1.2.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04579 · Published 2021-06-03 · Partial fix · 5.1.2 CWE-400
Priority LOW 37
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02218 · Published 2021-05-04 · Partial fix · 1.0.7 CWE-400
Priority LOW 30
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking.
CVSS 3.1MEDIUM 5.6· Network · No auth · No interaction · EPSS 0.02814 · Published 2021-11-23 · Partial fix CWE-79
THREATIST.IORead the docs