Red Hat Security Advisory: rh-nodejs8-nodejs security update

Fixed packages 5

Vulnerabilities 6

• High 7.5
  CVE-2018-20834

  Arbitrary File Overwrite in tar

  A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file …

  tar node-tar Debian npm
  Apr 30, 2019
• Unscored —
  CVE-2018-12116

  Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use un…

  The Node.js Project Node.js nodejs nodejs Debian Ubuntu Alpine
  Nov 28, 2018
• Unscored —
  CVE-2018-12121 EPSS 10%

  Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: B…

  The Node.js Project Node.js nodejs nodejs Debian Ubuntu Alpine
  Nov 28, 2018
• Unscored —
  CVE-2018-12122 EPSS 41%

  Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacke…

  The Node.js Project Node.js nodejs nodejs Debian Ubuntu Alpine
  Nov 28, 2018
• Unscored —
  CVE-2018-12123

  Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascri…

  The Node.js Project Node.js nodejs nodejs Debian Ubuntu Alpine
  Nov 28, 2018
• Unscored —
  CVE-2019-5737 Public exploit EPSS 16%

  In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker ca…

  Node.js Node.js nodejs nodejs Debian Ubuntu Alpine
  Mar 28, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1660998
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1661002
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1661005
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1661010
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690808
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1702338
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1821.json
• report
  https://access.redhat.com/security/cve/CVE-2018-12116
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12116
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12116
• report
  https://access.redhat.com/security/cve/CVE-2018-12121
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12121
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12121
• report
  https://access.redhat.com/security/cve/CVE-2018-12122
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12122
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12122
• report
  https://access.redhat.com/security/cve/CVE-2018-12123
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12123
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12123
• report
  https://access.redhat.com/security/cve/CVE-2018-20834
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-20834
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-20834
• article
  https://hackerone.com/reports/344595
• report
  https://access.redhat.com/security/cve/CVE-2019-5737
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-5737
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-5737
• article
  https://nodejs.org/ja/blog/vulnerability/february-2019-security-releases/