Red Hat Security Advisory: rh-nodejs12-nodejs security update

Fixed packages 5

Vulnerabilities 5

• Medium 5.6
  CVE-2020-7598 Public exploit

  Prototype Pollution in minimist

  minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

  js-jquery nodejs-nodemon minimist node-minimist Debian Ubuntu Azure Linux npm
  Mar 11, 2020
• Low 3.7
  CVE-2020-11080

  Denial of service in nghttp2

  In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…

  nghttp2 nghttp2 nodejs nodejs Debian Ubuntu Alpine
  Jun 3, 2020
• Unscored —
  CVE-2020-10531

  An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, lead…

  chromium-browser icu icu icu Debian Ubuntu Alpine
  Mar 12, 2020
• Unscored —
  CVE-2020-8172

  TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

  nodejs nodejs-current Alpine
  Jun 8, 2020
• Unscored —
  CVE-2020-8174

  napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

  nodejs nodejs nodejs nodejs-current Debian Ubuntu Alpine
  Jul 24, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1807349
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1813344
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1844929
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1845247
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1845256
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2895.json
• report
  https://access.redhat.com/security/cve/CVE-2020-7598
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7598
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7598
• article
  https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
• report
  https://access.redhat.com/security/cve/CVE-2020-8172
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8172
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8172
• report
  https://access.redhat.com/security/cve/CVE-2020-8174
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8174
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8174
• article
  https://hackerone.com/reports/784186
• report
  https://access.redhat.com/security/cve/CVE-2020-10531
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10531
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10531
• article
  https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html
• report
  https://access.redhat.com/security/cve/CVE-2020-11080
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-11080
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-11080
• article
  https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr