Skip to content
OpenAdvisories
High RHSA-2020:4903 4 CVEs

Red Hat Security Advisory: nodejs:12 security and bug fix update

Published Sep 13, 2024 · Updated Oct 14, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs 1:12.18.4-2.module+el8.1.0+8360+14141500
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-debuginfo 1:12.18.4-2.module+el8.1.0+8360+14141500
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-debugsource 1:12.18.4-2.module+el8.1.0+8360+14141500
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-devel 1:12.18.4-2.module+el8.1.0+8360+14141500
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-docs 1:12.18.4-2.module+el8.1.0+8360+14141500
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-full-i18n 1:12.18.4-2.module+el8.1.0+8360+14141500
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-nodemon 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-packaging 0:17-3.module+el8.1.0+3369+37ae6a45
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream npm 1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500

Vulnerabilities 4

  • High 7.3
    CVE-2020-8116

    dot-prop Prototype Pollution vulnerability

    Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

    js-jquery dot-prop node-dot-prop node-dot-prop Debian Ubuntu Azure Linux npm
  • Medium 4.4
    CVE-2020-15095

    Sensitive information exposure through logs in npm cli

    Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is print…

    npm cli npm npm Debian Ubuntu npm
  • Unscored —
    CVE-2020-8201

    Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspe…

    Node.js node nodejs nodejs Debian Alpine
  • Unscored —
    CVE-2020-8252

    The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined t…

    Node.js node nodejs libuv1 Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1856875
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1868196
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1879311
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1879315
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1883965
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4903.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-8116
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8116
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8116
  • article
    https://hackerone.com/reports/719856
  • report
    https://access.redhat.com/security/cve/CVE-2020-8201
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8201
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8201
  • report
    https://access.redhat.com/security/cve/CVE-2020-8252
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8252
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8252
  • report
    https://access.redhat.com/security/cve/CVE-2020-15095
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-15095
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-15095