Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
| Rocky Linux · 8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
Vulnerabilities 4
-
High 7.3CVE-2020-7774 EPSS 70%
Prototype Pollution
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
-
Medium 5.6
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…
-
Medium 5.3
yargs-parser Vulnerable to Prototype Pollution
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
-
Unscored —
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…