Skip to content
OpenAdvisories
High RHEA-2020:0330 3 CVEs

Red Hat Enhancement Advisory: nodejs:12 enhancement update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs 1:12.14.1-1.module+el8.1.0+5466+30f75629
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-debuginfo 1:12.14.1-1.module+el8.1.0+5466+30f75629
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-debugsource 1:12.14.1-1.module+el8.1.0+5466+30f75629
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-devel 1:12.14.1-1.module+el8.1.0+5466+30f75629
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-docs 1:12.14.1-1.module+el8.1.0+5466+30f75629
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-nodemon 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-packaging 0:17-3.module+el8.1.0+3369+37ae6a45
Red Hat · RHEL 8 enterprise_linux:8::appstream npm 1:6.13.4-1.12.14.1.1.module+el8.1.0+5466+30f75629

Vulnerabilities 3

  • High 7.7
    CVE-2019-16775

    Unauthorized File Access in npm CLI before before version 6.13.3

    Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.j…

    npm cli npm npm Debian Ubuntu npm
  • High 7.7
    CVE-2019-16776

    Unauthorized File Access in npm CLI before before version 6.13.3

    Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow …

    npm cli npm npm Debian Ubuntu npm
  • High 7.7
    CVE-2019-16777

    Arbitrary File Overwrite in npm CLI

    Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a se…

    npm cli npm npm Debian Ubuntu npm

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1791067
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhea-2020_0330.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-16775
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1788305
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16775
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16775
  • report
    https://access.redhat.com/security/cve/CVE-2019-16776
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1788310
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16776
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16776
  • report
    https://access.redhat.com/security/cve/CVE-2019-16777
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1788301
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16777
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16777