Red Hat Security Advisory: rh-nodejs12-nodejs security update

Fixed packages 5

Vulnerabilities 4

• High 7.3
  CVE-2020-7774 EPSS 70%

  Prototype Pollution

  The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

  nodejs y18n node-y18n node-y18n Debian Ubuntu Alpine npm
  Nov 17, 2020
• Medium 5.6
  CVE-2020-15366

  Prototype Pollution in Ajv

  An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…

  node-ajv node-ajv ajv Debian Ubuntu npm
  Jul 15, 2020
• Medium 5.3
  CVE-2020-7608

  yargs-parser Vulnerable to Prototype Pollution

  yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

  yargs-parser node-yargs-parser node-yargs-parser Debian Ubuntu npm
  Mar 16, 2020
• Unscored —
  CVE-2020-8277 Public exploit EPSS 54%

  A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…

  Node.js node nodejs nodejs-current Debian Azure Linux Alpine
  Nov 19, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857977
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898554
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898680
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5305.json
• report
  https://access.redhat.com/security/cve/CVE-2020-7608
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1840004
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7608
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7608
• report
  https://access.redhat.com/security/cve/CVE-2020-7774
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7774
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7774
• article
  https://snyk.io/vuln/SNYK-JS-Y18N-1021887
• report
  https://access.redhat.com/security/cve/CVE-2020-8277
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8277
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8277
• report
  https://access.redhat.com/security/cve/CVE-2020-15366
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15366
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15366
• article
  https://snyk.io/vuln/SNYK-JS-AJV-584908