Red Hat Security Advisory: rh-nodejs8-nodejs security update

Fixed packages 5

Vulnerabilities 5

• Unscored —
  CVE-2018-12115

  In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js unde…

  The Node.js Project Node.js nodejs nodejs Debian Ubuntu Alpine
  Aug 21, 2018
• Unscored —
  CVE-2018-7159

  The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such a…

  The Node.js Project Node.js nodejs nodejs Debian Ubuntu Azure Linux Alpine
  May 17, 2018
• Unscored —
  CVE-2018-7160

  The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform rem…

  The Node.js Project Node.js nodejs nodejs Debian Ubuntu Alpine
  May 17, 2018
• Unscored —
  CVE-2018-7161

  All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of s…

  The Node.js Project Node.js nodejs nodejs Debian Ubuntu Alpine
  Jun 13, 2018
• Unscored —
  CVE-2018-7167

  Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Servi…

  The Node.js Project Node.js nodejs nodejs Debian Ubuntu Alpine
  Jun 13, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1620219
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2949.json
• report
  https://access.redhat.com/security/cve/CVE-2018-7159
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1561981
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-7159
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-7159
• report
  https://access.redhat.com/security/cve/CVE-2018-7160
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1561979
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-7160
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-7160
• report
  https://access.redhat.com/security/cve/CVE-2018-7161
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1591013
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-7161
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-7161
• report
  https://access.redhat.com/security/cve/CVE-2018-7167
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1591006
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-7167
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-7167
• report
  https://access.redhat.com/security/cve/CVE-2018-12115
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12115
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12115