Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debuginfo | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debugsource | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-devel | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-docs | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-full-i18n | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | npm | 1:6.14.5-1.12.18.2.1.module+el8.2.0+7233+61d664c1 |
Vulnerabilities 4
-
Medium 5.6CVE-2020-7598 Public exploit
Prototype Pollution in minimist
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
-
Low 3.7
Denial of service in nghttp2
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…
-
Unscored —
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
-
Unscored —
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1813344
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1844929
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1845247
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1845256
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2852.json
-
report
https://access.redhat.com/security/cve/CVE-2020-7598
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-7598
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7598
-
article
https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
-
report
https://access.redhat.com/security/cve/CVE-2020-8172
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-8172
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-8172
-
report
https://access.redhat.com/security/cve/CVE-2020-8174
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-8174
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-8174
-
article
https://hackerone.com/reports/784186
-
report
https://access.redhat.com/security/cve/CVE-2020-11080
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-11080
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-11080
-
article
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr