Skip to content
OpenAdvisories
Critical RHSA-2020:2625 7 CVEs

Red Hat Security Advisory: rh-nodejs8-nodejs security update

Published Sep 13, 2024 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs8-nodejs 0:8.17.0-2.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs8-nodejs-debuginfo 0:8.17.0-2.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs8-nodejs-devel 0:8.17.0-2.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs8-nodejs-docs 0:8.17.0-2.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs8-npm 0:6.13.4-8.17.0.2.el7

Vulnerabilities 7

  • Critical 9.8
    CVE-2018-3750

    Prototype Pollution in deep-extend

    The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing p…

    node-deep-extend deep-extend node-deep-extend Debian Ubuntu npm
  • High 7.7
    CVE-2019-16775

    Unauthorized File Access in npm CLI before before version 6.13.3

    Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.j…

    npm cli npm npm Debian Ubuntu npm
  • High 7.7
    CVE-2019-16776

    Unauthorized File Access in npm CLI before before version 6.13.3

    Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow …

    npm cli npm npm Debian Ubuntu npm
  • High 7.7
    CVE-2019-16777

    Arbitrary File Overwrite in npm CLI

    Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a se…

    npm cli npm npm Debian Ubuntu npm
  • High 7.5
    CVE-2017-18077

    ReDoS in brace-expansion

    index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.

    brace-expansion node-brace-expansion Debian npm
  • High 7.5
    CVE-2018-3737

    Regular Expression Denial of Service in sshpk

    sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.

    HackerOne sshpk node module sshpk node-sshpk Debian Ubuntu npm
  • Low 2.5
    CVE-2017-18869

    Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

    A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

    chownr node-chownr node-chownr Debian Ubuntu npm

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1448380
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1567228
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1578246
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1611613
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1788301
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1788305
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1788310
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1829414
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2625.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-18077
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-18077
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-18077
  • report
    https://access.redhat.com/security/cve/CVE-2017-18869
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-18869
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-18869
  • report
    https://access.redhat.com/security/cve/CVE-2018-3737
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-3737
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-3737
  • report
    https://access.redhat.com/security/cve/CVE-2018-3750
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-3750
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-3750
  • article
    https://hackerone.com/reports/311333
  • article
    https://nodesecurity.io/advisories/612
  • report
    https://access.redhat.com/security/cve/CVE-2019-16775
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16775
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16775
  • report
    https://access.redhat.com/security/cve/CVE-2019-16776
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16776
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16776
  • report
    https://access.redhat.com/security/cve/CVE-2019-16777
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16777
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16777