ELSA-2021-0551 — Moderate: nodejs:14 security and bug fix update (Oracle Linux 8)

Summary

nodejs
[1:14.15.4-2]
- Add patch for yarn crash
- Resolves: RHBZ#1916465

[1:14.15.4-1]
- Security rebase to 14.15.4
- https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
- Resolves: RHBZ#1916463, RHBZ#1914788
- Resolves: RHBZ#1914785, RHBZ#1916387, RHBZ#1916389, RHBZ#1916390, RHBZ#1916690

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 8	nodejs	1:14.15.4-2.module+el8.3.0+9657+a08a905a
Oracle Linux · 8	nodejs-devel	1:14.15.4-2.module+el8.3.0+9657+a08a905a
Oracle Linux · 8	nodejs-docs	1:14.15.4-2.module+el8.3.0+9657+a08a905a
Oracle Linux · 8	nodejs-full-i18n	1:14.15.4-2.module+el8.3.0+9657+a08a905a
Oracle Linux · 8	nodejs-nodemon	0:2.0.3-1.module+el8.3.0+7818+6cd30d85
Oracle Linux · 8	nodejs-packaging	0:23-3.module+el8.3.0+7818+6cd30d85
Oracle Linux · 8	npm	1:6.14.10-1.14.15.4.2.module+el8.3.0+9657+a08a905a

Vulnerabilities 7

High 7.5

CVE-2020-7754

Regular Expression Denial of Service (ReDoS)

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

npm-user-validate npm

Oct 27, 2020
High 7.3

CVE-2020-7774 EPSS 70%

Prototype Pollution

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

nodejs y18n node-y18n node-y18n Debian Ubuntu Alpine npm

Nov 17, 2020
High 7.3

CVE-2020-7788

Prototype Pollution

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

js-jquery nodejs-nodemon node-ini node-ini Debian Ubuntu Azure Linux npm

Dec 11, 2020
Medium 5.6

CVE-2020-15366

Prototype Pollution in Ajv

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…

node-ajv node-ajv ajv Debian Ubuntu npm

Jul 15, 2020
Unscored —

CVE-2020-8265

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…

Node.js node nodejs nodejs Debian Ubuntu Alpine

Jan 6, 2021
Unscored —

CVE-2020-8277 Public exploit EPSS 54%

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…

Node.js node nodejs nodejs-current Debian Azure Linux Alpine

Nov 19, 2020
Unscored —

CVE-2020-8287 Public exploit EPSS 16%

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for ex…

Node.js node nodejs nodejs Debian Ubuntu Alpine

Jan 6, 2021

Moderate: nodejs:14 security and bug fix update (Oracle Linux 8)

Summary

Fixed packages 7

Vulnerabilities 7

Regular Expression Denial of Service (ReDoS)

Prototype Pollution

Prototype Pollution

Prototype Pollution in Ajv

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for ex…