High ELSA-2020-0598 3 CVEs

Important: nodejs:12 security update (Oracle Linux 8)

Published Feb 26, 2020 · Updated Feb 26, 2020

Ecosystem: Oracle Linux

Summary

nodejs
[1:12.16.1-1]
- Resolves: RHBZ#1800393, RHBZ#1800394, RHBZ#1800380
- Rebase to 12.16.1

nodejs-nodemon
nodejs-packaging

Fixed packages 6

Release	Package	Fixed in
Oracle Linux · 8	nodejs	1:12.16.1-1.module+el8.1.0+5548+c572d87b
Oracle Linux · 8	nodejs-devel	1:12.16.1-1.module+el8.1.0+5548+c572d87b
Oracle Linux · 8	nodejs-docs	1:12.16.1-1.module+el8.1.0+5548+c572d87b
Oracle Linux · 8	nodejs-nodemon	0:1.18.3-1.module+el8.1.0+5393+aaf413e3
Oracle Linux · 8	nodejs-packaging	0:17-3.module+el8.1.0+5393+aaf413e3
Oracle Linux · 8	npm	1:6.13.4-1.12.16.1.1.module+el8.1.0+5548+c572d87b

Vulnerabilities 3

Unscored —

CVE-2019-15604 EPSS 20%

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 cert…

Node.js node nodejs nodejs Debian Ubuntu Alpine

Feb 7, 2020
Unscored —

CVE-2019-15605 Public exploit EPSS 57%

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Node.js node nodejs nodejs Debian Ubuntu Alpine

Feb 7, 2020
Unscored —

CVE-2019-15606 EPSS 20%

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on h…

Node.js node nodejs nodejs Debian Ubuntu Alpine

Feb 7, 2020