Summary
nodejs
[1:12.18.4-2]
- Resolves: RHBZ#1883966 - nodejs-devel not installable due to missing brotli
- Some spec fixes
[12.18.4-1]
- Rebase to 12.18.4
nodejs-nodemon
nodejs-packaging
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | nodejs | 1:12.18.4-2.module+el8.2.0+7806+0b44ae23 |
| Oracle Linux · 8 | nodejs-devel | 1:12.18.4-2.module+el8.2.0+7806+0b44ae23 |
| Oracle Linux · 8 | nodejs-docs | 1:12.18.4-2.module+el8.2.0+7806+0b44ae23 |
| Oracle Linux · 8 | nodejs-full-i18n | 1:12.18.4-2.module+el8.2.0+7806+0b44ae23 |
| Oracle Linux · 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux · 8 | nodejs-packaging | 0:17-3.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux · 8 | npm | 1:6.14.6-1.12.18.4.2.module+el8.2.0+7806+0b44ae23 |
Vulnerabilities 4
-
High 7.3
dot-prop Prototype Pollution vulnerability
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
-
Medium 4.4
Sensitive information exposure through logs in npm cli
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is print…
-
Unscored —
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspe…
-
Unscored —
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined t…