Summary
nodejs
[1:12.19.1-1]
- Resolves: RHBZ#1901044, #1901045, #1901046, #1901047
- c-ares, ajv and y18n CVEs and yarn installability issues
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | nodejs | 1:12.19.1-1.module+el8.3.0+7884+668e4ef8 |
| Oracle Linux · 8 | nodejs-devel | 1:12.19.1-1.module+el8.3.0+7884+668e4ef8 |
| Oracle Linux · 8 | nodejs-docs | 1:12.19.1-1.module+el8.3.0+7884+668e4ef8 |
| Oracle Linux · 8 | nodejs-full-i18n | 1:12.19.1-1.module+el8.3.0+7884+668e4ef8 |
| Oracle Linux · 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux · 8 | nodejs-packaging | 0:17-3.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux · 8 | npm | 1:6.14.8-1.12.19.1.1.module+el8.3.0+7884+668e4ef8 |
Vulnerabilities 3
-
High 7.3CVE-2020-7774 EPSS 70%
Prototype Pollution
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
-
Medium 5.6
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…
-
Unscored —
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…