Red Hat Security AdvisoryRHSA-2022:4914
rh-nodejs12-nodejs security, bug fix, and enhancement update
Released 2022-06-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs12-nodejs-12.22.12-2.el7, rh-nodejs12-nodejs-devel-12.22.12-2.el7, rh-nodejs12-nodejs-docs-12.22.12-2.el7 +1
- Red Hat Software Collections for RHEL(v. 7) rh-nodejs12-nodejs-12.22.12-2.el7, rh-nodejs12-nodejs-devel-12.22.12-2.el7, rh-nodejs12-nodejs-docs-12.22.12-2.el7 +1
Fixes 10 records
Priority MEDIUM 56
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04581 · Published 2022-03-17 · Partial fix · 1.2.6, 0.2.4 CWE-1321
Priority MEDIUM 55
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.21514 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-471
Priority MEDIUM 49
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0383 · Published 2021-11-13 · Partial fix · 0.4.0 CWE-1321
Priority MEDIUM 43
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.08373 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-295
Priority MEDIUM 43
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability.
CVSS 3.1HIGH 8.6· Local · No auth · User interaction · EPSS 0.03286 · Published 2021-08-31 · Partial fix · 4.4.16, 5.0.8 +1 CWE-22
Priority MEDIUM 42
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.09358 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-295
Priority MEDIUM 41
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability.
CVSS 3.1HIGH 8.6· Local · No auth · User interaction · EPSS 0.01865 · Published 2021-08-31 · Partial fix · 4.4.18, 5.0.10 +1 CWE-22
Priority LOW 37
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.10364 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-296
Priority LOW 35
The parser in accepts requests with a space (SP) right after the header name before the colon.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.03156 · Published 2021-11-15 · Partial fix · 12.22.7, 14.18.1 +1 CWE-444
Priority LOW 34
The parse function in llhttp < 2.1.4 and < 6.0.6.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02472 · Published 2021-11-03 · Partial fix · 12.22.7, 14.18.1 +1 CWE-444
THREATIST.IORead the docs