Red Hat Security Advisory: nodejs:14 security and bug fix update

Fixed packages 9

Vulnerabilities 7

• High 7.5
  CVE-2020-7754

  Regular Expression Denial of Service (ReDoS)

  This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

  npm-user-validate npm
  Oct 27, 2020
• High 7.3
  CVE-2020-7774 EPSS 70%

  Prototype Pollution

  The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

  nodejs y18n node-y18n node-y18n Debian Ubuntu Alpine npm
  Nov 17, 2020
• High 7.3
  CVE-2020-7788

  Prototype Pollution

  This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

  js-jquery nodejs-nodemon node-ini node-ini Debian Ubuntu Azure Linux npm
  Dec 11, 2020
• Medium 5.6
  CVE-2020-15366

  Prototype Pollution in Ajv

  An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…

  node-ajv node-ajv ajv Debian Ubuntu npm
  Jul 15, 2020
• Unscored —
  CVE-2020-8265

  Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Jan 6, 2021
• Unscored —
  CVE-2020-8277 Public exploit EPSS 54%

  A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…

  Node.js node nodejs nodejs-current Debian Azure Linux Alpine
  Nov 19, 2020
• Unscored —
  CVE-2020-8287 Public exploit EPSS 16%

  Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for ex…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Jan 6, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857977
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1892430
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898554
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1898680
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1907444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1912854
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1912863
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0551.json
• report
  https://access.redhat.com/security/cve/CVE-2020-7754
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7754
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7754
• article
  https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p
• report
  https://access.redhat.com/security/cve/CVE-2020-7774
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7774
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7774
• article
  https://snyk.io/vuln/SNYK-JS-Y18N-1021887
• report
  https://access.redhat.com/security/cve/CVE-2020-7788
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7788
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7788
• report
  https://access.redhat.com/security/cve/CVE-2020-8265
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8265
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8265
• article
  https://hackerone.com/reports/988103
• report
  https://access.redhat.com/security/cve/CVE-2020-8277
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8277
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8277
• report
  https://access.redhat.com/security/cve/CVE-2020-8287
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8287
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8287
• report
  https://access.redhat.com/security/cve/CVE-2020-15366
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15366
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15366
• article
  https://snyk.io/vuln/SNYK-JS-AJV-584908