Summary
nodejs
[1:10.21.0-3]
- Resolves: RHBZ#1845306
- Remove brotli-devel requires from nodejs-devel
[1:10.21.0-2]
- Resolves: RHBZ#1845306
- Turn off debug builds
[1:10.21.0-1]
- Security update to 10.21.0
- Resolves: RHBZ#1845306
- Fixes CVE-2020-11080, CVE-2020-8174, CVE-2020-10531
- Bundle brotli, because --shared-brotli configure option is missing
- Add i18n subpackage
nodejs-nodemon
nodejs-packaging
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | nodejs | 1:10.21.0-3.module+el8.2.0+7635+4ebb0540 |
| Oracle Linux · 8 | nodejs-devel | 1:10.21.0-3.module+el8.2.0+7635+4ebb0540 |
| Oracle Linux · 8 | nodejs-docs | 1:10.21.0-3.module+el8.2.0+7635+4ebb0540 |
| Oracle Linux · 8 | nodejs-full-i18n | 1:10.21.0-3.module+el8.2.0+7635+4ebb0540 |
| Oracle Linux · 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+5392+4d6b561f |
| Oracle Linux · 8 | nodejs-packaging | 0:17-3.module+el8.1.0+5392+4d6b561f |
| Oracle Linux · 8 | npm | 1:6.14.4-1.10.21.0.3.module+el8.2.0+7635+4ebb0540 |
Vulnerabilities 3
-
Medium 5.6CVE-2020-7598 Public exploit
Prototype Pollution in minimist
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
-
Low 3.7
Denial of service in nghttp2
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…
-
Unscored —
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.