Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debuginfo | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debugsource | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-devel | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-docs | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-full-i18n | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | npm | 1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0 |
Vulnerabilities 4
-
High 7.3CVE-2020-7774 EPSS 70%
Prototype Pollution
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
-
Medium 5.6
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…
-
Medium 5.3
yargs-parser Vulnerable to Prototype Pollution
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
-
Unscored —
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1857977
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1898554
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1898680
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5499.json
-
report
https://access.redhat.com/security/cve/CVE-2020-7608
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1840004
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-7608
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7608
-
report
https://access.redhat.com/security/cve/CVE-2020-7774
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-7774
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7774
-
article
https://snyk.io/vuln/SNYK-JS-Y18N-1021887
-
report
https://access.redhat.com/security/cve/CVE-2020-8277
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-8277
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-8277
-
report
https://access.redhat.com/security/cve/CVE-2020-15366
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-15366
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-15366
-
article
https://snyk.io/vuln/SNYK-JS-AJV-584908