Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (14.15.4).
Security Fix(es):
* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| Rocky Linux · 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.3.0+100+234774f7 |
| Rocky Linux · 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.4.0+638+5344c6f7 |
| Rocky Linux · 8 | nodejs-packaging | 0:23-3.module+el8.7.0+1071+4bdda2a8 |
| Rocky Linux · 8 | nodejs-packaging | 0:23-3.module+el8.3.0+100+234774f7 |
| Rocky Linux · 8 | nodejs-packaging | 0:23-3.module+el8.5.0+733+de4fee6c |
Vulnerabilities 7
-
High 7.5
Regular Expression Denial of Service (ReDoS)
This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
-
High 7.3CVE-2020-7774 EPSS 70%
Prototype Pollution
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
-
High 7.3
Prototype Pollution
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
-
Medium 5.6
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…
-
Unscored —
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…
-
Unscored —
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…
-
Unscored —
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for ex…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1857977
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1892430
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1898554
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1898680
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1907444
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1912854
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1912863