Skip to content
OpenAdvisories
Medium ELSA-2021-0549 6 CVEs

Moderate: nodejs:12 security update (Oracle Linux 8)

Published Feb 20, 2021 · Updated Feb 20, 2021

Ecosystem: Oracle Linux

Summary

nodejs
[1:12.20.1-1]
- Security rebase for January security release
- https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
- Resolves: RHBZ#1916460, RHBZ#1914786
- Resolves: RHBZ#1914784, RHBZ#1916396

nodejs-nodemon
[2.0.3-1]
- Resolves: RHBZ#1921841, RHBZ#1921843, RHBZ#1921842
- Rebase to 2.0.3

nodejs-packaging

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 8 nodejs 1:12.20.1-1.module+el8.3.0+9643+8c99e187
Oracle Linux · 8 nodejs-devel 1:12.20.1-1.module+el8.3.0+9643+8c99e187
Oracle Linux · 8 nodejs-docs 1:12.20.1-1.module+el8.3.0+9643+8c99e187
Oracle Linux · 8 nodejs-full-i18n 1:12.20.1-1.module+el8.3.0+9643+8c99e187
Oracle Linux · 8 nodejs-nodemon 0:2.0.3-1.module+el8.3.0+9643+8c99e187
Oracle Linux · 8 nodejs-packaging 0:17-3.module+el8.1.0+5393+aaf413e3
Oracle Linux · 8 npm 1:6.14.10-1.12.20.1.1.module+el8.3.0+9643+8c99e187

Vulnerabilities 6

  • Critical 9.8
    CVE-2019-10746

    Prototype Pollution in mixin-deep

    mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

    mixin-deep node-mixin-deep node-mixin-deep Debian Ubuntu npm
  • Critical 9.8
    CVE-2019-10747

    Prototype Pollution in set-value

    set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.

    set-value node-set-value node-set-value Debian Ubuntu npm
  • High 7.5
    CVE-2020-7754

    Regular Expression Denial of Service (ReDoS)

    This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

    npm-user-validate npm
  • High 7.3
    CVE-2020-7788

    Prototype Pollution

    This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

    js-jquery nodejs-nodemon ini node-ini Debian Ubuntu Azure Linux npm
  • Unscored —
    CVE-2020-8265

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…

    Node.js node nodejs nodejs Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-8287 Public exploit EPSS 16%

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for ex…

    Node.js node nodejs nodejs Debian Ubuntu Alpine