Action not permitted
Modal body text goes here.
CVE-2020-7608
Vulnerability from cvelistv5
Published
2020-03-16 19:49
Modified
2024-08-04 09:33
Severity ?
EPSS score ?
Summary
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
References
▼ | URL | Tags | |
---|---|---|---|
report@snyk.io | https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381 | Exploit, Patch, Third Party Advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
n/a | yargs-parser |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T09:33:19.972Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "yargs-parser", "vendor": "n/a", "versions": [ { "status": "affected", "version": "All versions prior to version 18.1.1 and patches at 13.1.2 and 15.0.1" } ] } ], "descriptions": [ { "lang": "en", "value": "yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload." } ], "problemTypes": [ { "descriptions": [ { "description": "Prototype Pollution", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-03-16T19:49:49", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "report@snyk.io", "ID": "CVE-2020-7608", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "yargs-parser", "version": { "version_data": [ { "version_value": "All versions prior to version 18.1.1 and patches at 13.1.2 and 15.0.1" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Prototype Pollution" } ] } ] }, "references": { "reference_data": [ { "name": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381" } ] } } } }, "cveMetadata": { "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2020-7608", "datePublished": "2020-03-16T19:49:49", "dateReserved": "2020-01-21T00:00:00", "dateUpdated": "2024-08-04T09:33:19.972Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2020-7608\",\"sourceIdentifier\":\"report@snyk.io\",\"published\":\"2020-03-16T20:15:12.860\",\"lastModified\":\"2022-11-15T16:40:49.237\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \\\"__proto__\\\" payload.\"},{\"lang\":\"es\",\"value\":\"Yargs-parser podr\u00eda ser enga\u00f1ado para agregar o modificar propiedades de Object.prototype utilizando una carga \u00fatil \\\"__proto__\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":4.6},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1321\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yargs:yargs-parser:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"5.0.1\",\"matchCriteriaId\":\"63B6B264-EBB0-4B92-94AB-9BBFA0BC722A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yargs:yargs-parser:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"13.1.2\",\"matchCriteriaId\":\"A702209A-7B6A-42E9-BDC3-C4F822509ABA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yargs:yargs-parser:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"14.0.0\",\"versionEndExcluding\":\"15.0.1\",\"matchCriteriaId\":\"1DF881DA-B1DF-4EE6-8141-AD77BD7B84C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yargs:yargs-parser:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"16.0.0\",\"versionEndExcluding\":\"18.1.1\",\"matchCriteriaId\":\"491D24EB-1D85-4676-8EF3-B0C358E8A584\"}]}]}],\"references\":[{\"url\":\"https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381\",\"source\":\"report@snyk.io\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]}]}}" } }
ghsa-p9pc-299p-vxgp
Vulnerability from github
Published
2020-09-04 18:00
Modified
2022-08-02 21:44
Severity ?
Summary
yargs-parser Vulnerable to Prototype Pollution
Details
Affected versions of yargs-parser
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz'
adds a bar
property with value baz
to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser
.
Recommendation
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
{ "affected": [ { "package": { "ecosystem": "npm", "name": "yargs-parser" }, "ranges": [ { "events": [ { "introduced": "6.0.0" }, { "fixed": "13.1.2" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "npm", "name": "yargs-parser" }, "ranges": [ { "events": [ { "introduced": "14.0.0" }, { "fixed": "15.0.1" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "npm", "name": "yargs-parser" }, "ranges": [ { "events": [ { "introduced": "16.0.0" }, { "fixed": "18.1.1" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 5.0.0" }, "package": { "ecosystem": "npm", "name": "yargs-parser" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "5.0.1" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2020-7608" ], "database_specific": { "cwe_ids": [ "CWE-1321", "CWE-915" ], "github_reviewed": true, "github_reviewed_at": "2020-08-31T19:01:32Z", "nvd_published_at": "2020-03-16T20:15:00Z", "severity": "MODERATE" }, "details": "Affected versions of `yargs-parser` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. \nParsing the argument `--foo.__proto__.bar baz\u0027` adds a `bar` property with value `baz` to all objects. This is only exploitable if attackers have control over the arguments being passed to `yargs-parser`.\n\n\n\n## Recommendation\n\nUpgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.", "id": "GHSA-p9pc-299p-vxgp", "modified": "2022-08-02T21:44:02Z", "published": "2020-09-04T18:00:54Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608" }, { "type": "WEB", "url": "https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36" }, { "type": "WEB", "url": "https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2" }, { "type": "PACKAGE", "url": "https://github.com/yargs/yargs-parser" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381" }, { "type": "WEB", "url": "https://www.npmjs.com/advisories/1500" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "type": "CVSS_V3" } ], "summary": "yargs-parser Vulnerable to Prototype Pollution" }
rhsa-2021_0521
Vulnerability from csaf_redhat
Published
2021-02-15 18:28
Modified
2024-11-05 23:17
Summary
Red Hat Security Advisory: rh-nodejs10-nodejs security update
Notes
Topic
An update for rh-nodejs10-nodejs is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.23.1).
Security Fix(es):
* libuv: buffer overflow in realpath (CVE-2020-8252)
* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs-dot-prop: prototype pollution (CVE-2020-8116)
* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
* npm: sensitive information exposure through logs (CVE-2020-15095)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs10-nodejs is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2021:0521", "url": "https://access.redhat.com/errata/RHSA-2021:0521" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "1892430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892430" }, { "category": "external", "summary": "1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "1912854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912854" }, { "category": "external", "summary": "1912863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912863" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0521.json" } ], "title": "Red Hat Security Advisory: rh-nodejs10-nodejs security update", "tracking": { "current_release_date": "2024-11-05T23:17:35+00:00", "generator": { "date": "2024-11-05T23:17:35+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2021:0521", "initial_release_date": "2021-02-15T18:28:29+00:00", "revision_history": [ { "date": "2021-02-15T18:28:29+00:00", "number": "1", "summary": "Initial version" }, { "date": "2021-02-15T18:28:29+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T23:17:35+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "product": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "product_id": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs@10.23.1-2.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "product": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "product_id": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs@10.23.1-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "product": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "product_id": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-devel@10.23.1-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "product": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "product_id": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-npm@6.14.10-10.23.1.2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "product": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "product_id": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-debuginfo@10.23.1-2.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "product": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "product_id": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs@10.23.1-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "product": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "product_id": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-devel@10.23.1-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "product": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "product_id": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-npm@6.14.10-10.23.1.2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "product": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "product_id": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-debuginfo@10.23.1-2.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "product": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "product_id": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs@10.23.1-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "product": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "product_id": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-devel@10.23.1-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "product": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "product_id": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-npm@6.14.10-10.23.1.2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "product": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "product_id": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-debuginfo@10.23.1-2.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "product": { "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "product_id": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-docs@10.23.1-2.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch" }, "product_reference": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch" }, "product_reference": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch" }, "product_reference": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch" }, "product_reference": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7608", "cwe": { "id": "CWE-267", "name": "Privilege Defined With Unsafe Actions" }, "discovery_date": "2020-05-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1840004" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-yargs-parser: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7608" }, { "category": "external", "summary": "RHBZ#1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7608", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7608" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608" } ], "release_date": "2020-03-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-yargs-parser: prototype pollution vulnerability" }, { "cve": "CVE-2020-7754", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1892430" } ], "notes": [ { "category": "description", "text": "This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat Enterprise Linux 8 and Software Collections, `npm-user-validate` is used exclusively for `npm`. As a result, this vulnerability is considered Low in such a context.\n\nIn OpenShift Container Platform (OCP) 3.11 and 4.4 the kibana package has been marked Low (similar to RHEL8) as it is primarily used for npm and is protected via OpenShift OAuth. Additionally, whilst OCP 4.4 does deliver the kibana package, due to the code changing to container first content, it has been marked as wontfix at this time and may be fixed in a future release. \n\nAdditionally, the openshift4/ose-logging-kibana6 container is not represented on the CVE page as it gets npm from the Red Hat Software Collections and as such the ose-logging-kibana6 container will be updated when the rh-nodejs10-nodejs package is.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7754" }, { "category": "external", "summary": "RHBZ#1892430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892430" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7754", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7754" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7754", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7754" }, { "category": "external", "summary": "https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p", "url": "https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p" } ], "release_date": "2020-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS" }, { "cve": "CVE-2020-7774", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2020-11-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1898680" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n\u0027s locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-y18n: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and OpenShift distributed tracing the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-y18n library to authenticated users only, therefore the impact is Low.\n\nIn Red Hat OpenShift Container Storage 4 the noobaa-core container includes the affected version of y18n as a dependency of yargs. However, no unsafe usage found where the module accepts untrusted input and hence this issue has been rated as having a security impact of Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7774" }, { "category": "external", "summary": "RHBZ#1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7774", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7774" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887", "url": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887" } ], "release_date": "2020-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-y18n: prototype pollution vulnerability" }, { "cve": "CVE-2020-7788", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-12-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1907444" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ini: Prototype pollution via malicious INI file", "title": "Vulnerability summary" }, { "category": "other", "text": "Node.JS packages in Red Hat Enterprise Linux and Red Hat Software Collections included the vulnerable dependency packaged in \"nodejs-npm\" component. Processing malicious files using npm could potentially trigger this vulnerability. The \"ini\" package bundled with npm was not in the library path where it could be included directly in other programs.\n\nThe nodejs-nodemon packages in Red Hat Enterprise Linux and Red Hat Software Collections are affected by this vulnerability as they bundle the nodejs-ini library. Usage of that library is governed by nodemon itself, so applications started by nodemon are not impacted. Further, nodemon is a developer tool not intended to be used in production.\n\nThe ini package is included in Red Hat Quay by protractor and webpack-cli, both of which are dev dependencies.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7788" }, { "category": "external", "summary": "RHBZ#1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7788", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7788" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788" } ], "release_date": "2020-12-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ini: Prototype pollution via malicious INI file" }, { "cve": "CVE-2020-8116", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-08-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1868196" } ], "notes": [ { "category": "description", "text": "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-dot-prop: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8116" }, { "category": "external", "summary": "RHBZ#1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8116", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8116" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116" }, { "category": "external", "summary": "https://hackerone.com/reports/719856", "url": "https://hackerone.com/reports/719856" } ], "release_date": "2020-01-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-dot-prop: prototype pollution" }, { "cve": "CVE-2020-8252", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-09-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1879315" } ], "notes": [ { "category": "description", "text": "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "libuv: buffer overflow in realpath", "title": "Vulnerability summary" }, { "category": "other", "text": "As shipped in Red Hat Software Collections (nodejs-10 \u0026 nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8252" }, { "category": "external", "summary": "RHBZ#1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8252", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8252" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libuv: buffer overflow in realpath" }, { "cve": "CVE-2020-8265", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2021-01-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1912854" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: use-after-free in the TLS implementation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8265" }, { "category": "external", "summary": "RHBZ#1912854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912854" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8265", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8265" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8265", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8265" }, { "category": "external", "summary": "https://hackerone.com/reports/988103", "url": "https://hackerone.com/reports/988103" } ], "release_date": "2021-01-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: use-after-free in the TLS implementation" }, { "cve": "CVE-2020-8287", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-01-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1912863" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP request smuggling via two copies of a header field in an http request", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8287" }, { "category": "external", "summary": "RHBZ#1912863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912863" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8287", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8287" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8287", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8287" } ], "release_date": "2021-01-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: HTTP request smuggling via two copies of a header field in an http request" }, { "cve": "CVE-2020-15095", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2020-07-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1856875" } ], "notes": [ { "category": "description", "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.", "title": "Vulnerability description" }, { "category": "summary", "text": "npm: sensitive information exposure through logs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15095" }, { "category": "external", "summary": "RHBZ#1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15095", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15095" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095" } ], "release_date": "2020-07-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" }, { "category": "workaround", "details": "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm: sensitive information exposure through logs" }, { "cve": "CVE-2020-15366", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1857977" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-ajv library to authenticated users only, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15366" }, { "category": "external", "summary": "RHBZ#1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15366", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15366" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-AJV-584908", "url": "https://snyk.io/vuln/SNYK-JS-AJV-584908" } ], "release_date": "2020-07-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function" } ] }
rhsa-2021_3917
Vulnerability from csaf_redhat
Published
2021-10-19 12:09
Modified
2024-09-14 01:23
Summary
Red Hat Security Advisory: Red Hat Quay v3.6.0 security, bug fix and enhancement update
Notes
Topic
An update is now available for Red Hat Quay 3.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Quay 3.6.0 release
Security Fix(es):
* nodejs-url-parse: incorrect hostname in url parsing (CVE-2018-3774)
* python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c (CVE-2021-25289)
* nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise (CVE-2021-27516)
* nodejs-debug: Regular expression Denial of Service (CVE-2017-16137)
* nodejs-mime: Regular expression Denial of Service (CVE-2017-16138)
* nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format (CVE-2018-1107)
* nodejs-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-16492)
* nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure (CVE-2018-21270)
* nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution (CVE-2019-20920)
* nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS (CVE-2019-20922)
* nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
* nodejs-highlight-js: prototype pollution via a crafted HTML code block (CVE-2020-26237)
* urijs: Hostname spoofing via backslashes in URL (CVE-2020-26291)
* python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow (CVE-2020-35654)
* browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) (CVE-2021-23364)
* nodejs-postcss: Regular expression denial of service during source map parsing (CVE-2021-23368)
* nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js (CVE-2021-23382)
* python-pillow: negative-offset memcpy with an invalid size in TiffDecode.c (CVE-2021-25290)
* python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c (CVE-2021-25291)
* python-pillow: backtracking regex in PDF parser could be used as a DOS attack (CVE-2021-25292)
* python-pillow: out-of-bounds read in SGIRleDecode.c (CVE-2021-25293)
* nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise (CVE-2021-27515)
* python-pillow: reported size of a contained image is not properly checked for a BLP container (CVE-2021-27921)
* python-pillow: reported size of a contained image is not properly checked for an ICNS container (CVE-2021-27922)
* python-pillow: reported size of a contained image is not properly checked for an ICO container (CVE-2021-27923)
* python-pillow: buffer overflow in Convert.c because it allow an attacker to pass controlled parameters directly into a convert function (CVE-2021-34552)
* nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js (CVE-2018-1109)
* lodash: Prototype pollution in utilities function (CVE-2018-3721)
* hoek: Prototype pollution in utilities function (CVE-2018-3728)
* lodash: uncontrolled resource consumption in Data handler causing denial of service (CVE-2019-1010266)
* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
* python-pillow: decoding a crafted PCX file could result in buffer over-read (CVE-2020-35653)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat Quay 3.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Quay 3.6.0 release\n\nSecurity Fix(es):\n\n* nodejs-url-parse: incorrect hostname in url parsing (CVE-2018-3774)\n\n* python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c (CVE-2021-25289)\n\n* nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise (CVE-2021-27516)\n\n* nodejs-debug: Regular expression Denial of Service (CVE-2017-16137)\n\n* nodejs-mime: Regular expression Denial of Service (CVE-2017-16138)\n\n* nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format (CVE-2018-1107)\n\n* nodejs-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-16492)\n\n* nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure (CVE-2018-21270)\n\n* nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution (CVE-2019-20920)\n\n* nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS (CVE-2019-20922)\n\n* nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-highlight-js: prototype pollution via a crafted HTML code block (CVE-2020-26237)\n\n* urijs: Hostname spoofing via backslashes in URL (CVE-2020-26291)\n\n* python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow (CVE-2020-35654)\n\n* browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) (CVE-2021-23364)\n\n* nodejs-postcss: Regular expression denial of service during source map parsing (CVE-2021-23368)\n\n* nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js (CVE-2021-23382)\n\n* python-pillow: negative-offset memcpy with an invalid size in TiffDecode.c (CVE-2021-25290)\n\n* python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c (CVE-2021-25291)\n\n* python-pillow: backtracking regex in PDF parser could be used as a DOS attack (CVE-2021-25292)\n\n* python-pillow: out-of-bounds read in SGIRleDecode.c (CVE-2021-25293)\n\n* nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise (CVE-2021-27515)\n\n* python-pillow: reported size of a contained image is not properly checked for a BLP container (CVE-2021-27921)\n\n* python-pillow: reported size of a contained image is not properly checked for an ICNS container (CVE-2021-27922)\n\n* python-pillow: reported size of a contained image is not properly checked for an ICO container (CVE-2021-27923)\n\n* python-pillow: buffer overflow in Convert.c because it allow an attacker to pass controlled parameters directly into a convert function (CVE-2021-34552)\n\n* nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js (CVE-2018-1109)\n\n* lodash: Prototype pollution in utilities function (CVE-2018-3721)\n\n* hoek: Prototype pollution in utilities function (CVE-2018-3728)\n\n* lodash: uncontrolled resource consumption in Data handler causing denial of service (CVE-2019-1010266)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* python-pillow: decoding a crafted PCX file could result in buffer over-read (CVE-2020-35653)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2021:3917", "url": "https://access.redhat.com/errata/RHSA-2021:3917" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1500700", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500700" }, { "category": "external", "summary": "1500705", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500705" }, { "category": "external", "summary": "1545884", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1545884" }, { "category": "external", "summary": "1545893", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1545893" }, { "category": "external", "summary": "1546357", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1546357" }, { "category": "external", "summary": "1547272", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547272" }, { "category": "external", "summary": "1608140", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1608140" }, { "category": "external", "summary": "1743096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743096" }, { "category": "external", "summary": "1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "1857412", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857412" }, { "category": "external", "summary": "1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "1882256", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882256" }, { "category": "external", "summary": "1882260", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882260" }, { "category": "external", "summary": "1901662", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901662" }, { "category": "external", "summary": "1915257", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915257" }, { "category": "external", "summary": "1915420", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915420" }, { "category": "external", "summary": "1915424", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915424" }, { "category": "external", "summary": "1927293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927293" }, { "category": "external", "summary": "1934470", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934470" }, { "category": "external", "summary": "1934474", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934474" }, { "category": "external", "summary": "1934680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934680" }, { "category": "external", "summary": "1934685", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934685" }, { "category": "external", "summary": "1934692", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934692" }, { "category": "external", "summary": "1934699", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934699" }, { "category": "external", "summary": "1934705", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934705" }, { "category": "external", "summary": "1935384", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935384" }, { "category": "external", "summary": "1935396", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935396" }, { "category": "external", "summary": "1935401", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935401" }, { "category": "external", "summary": "1940759", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940759" }, { "category": "external", "summary": "1948763", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1948763" }, { "category": "external", "summary": "1954150", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954150" }, { "category": "external", "summary": "1955619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955619" }, { "category": "external", "summary": "1982378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982378" }, { "category": "external", "summary": "PROJQUAY-1417", "url": "https://issues.redhat.com/browse/PROJQUAY-1417" }, { "category": "external", "summary": "PROJQUAY-1449", "url": "https://issues.redhat.com/browse/PROJQUAY-1449" }, { "category": "external", "summary": "PROJQUAY-1535", "url": "https://issues.redhat.com/browse/PROJQUAY-1535" }, { "category": "external", "summary": "PROJQUAY-1583", "url": "https://issues.redhat.com/browse/PROJQUAY-1583" }, { "category": "external", "summary": "PROJQUAY-1609", "url": "https://issues.redhat.com/browse/PROJQUAY-1609" }, { "category": "external", "summary": "PROJQUAY-1610", "url": "https://issues.redhat.com/browse/PROJQUAY-1610" }, { "category": "external", "summary": "PROJQUAY-1791", "url": "https://issues.redhat.com/browse/PROJQUAY-1791" }, { "category": "external", "summary": "PROJQUAY-1883", "url": "https://issues.redhat.com/browse/PROJQUAY-1883" }, { "category": "external", "summary": "PROJQUAY-1887", "url": "https://issues.redhat.com/browse/PROJQUAY-1887" }, { "category": "external", "summary": "PROJQUAY-1926", "url": "https://issues.redhat.com/browse/PROJQUAY-1926" }, { "category": "external", "summary": "PROJQUAY-1998", "url": "https://issues.redhat.com/browse/PROJQUAY-1998" }, { "category": "external", "summary": "PROJQUAY-2050", "url": "https://issues.redhat.com/browse/PROJQUAY-2050" }, { "category": "external", "summary": "PROJQUAY-2100", "url": "https://issues.redhat.com/browse/PROJQUAY-2100" }, { "category": "external", "summary": "PROJQUAY-2102", "url": "https://issues.redhat.com/browse/PROJQUAY-2102" }, { "category": "external", "summary": "PROJQUAY-672", "url": "https://issues.redhat.com/browse/PROJQUAY-672" }, { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2021/rhsa-2021_3917.json" } ], "title": "Red Hat Security Advisory: Red Hat Quay v3.6.0 security, bug fix and enhancement update", "tracking": { "current_release_date": "2024-09-14T01:23:23+00:00", "generator": { "date": "2024-09-14T01:23:23+00:00", "engine": { "name": "Red Hat SDEngine", "version": "3.33.3" } }, "id": "RHSA-2021:3917", "initial_release_date": "2021-10-19T12:09:35+00:00", "revision_history": [ { "date": "2021-10-19T12:09:35+00:00", "number": "1", "summary": "Initial version" }, { "date": "2021-10-19T12:09:35+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-09-14T01:23:23+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Quay v3", "product": { "name": "Quay v3", "product_id": "8Base-Quay-3", "product_identification_helper": { "cpe": "cpe:/a:redhat:quay:3::el8" } } } ], "category": "product_family", "name": "Red Hat Quay" }, { "branches": [ { "category": "product_version", "name": "quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "product": { "name": "quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "product_id": "quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.6.0-35" } } }, { "category": "product_version", "name": "quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "product": { "name": "quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "product_id": "quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.6.0-40" } } }, { "category": "product_version", "name": "quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "product": { "name": "quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "product_id": "quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.6.0-44" } } }, { "category": "product_version", "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "product": { "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.6.0-45" } } }, { "category": "product_version", "name": "quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "product": { "name": "quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "product_id": "quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "product_identification_helper": { "purl": "pkg:oci/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.6.0-70" } } }, { "category": "product_version", "name": "quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "product": { "name": "quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "product_id": "quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.6.0-37" } } }, { "category": "product_version", "name": "quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "product": { "name": "quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "product_id": "quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.6.0-44" } } }, { "category": "product_version", "name": "quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "product": { "name": "quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "product_id": "quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.6.0-48" } } }, { "category": "product_version", "name": "quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "product": { "name": "quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "product_id": "quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.6.0-43" } } }, { "category": "product_version", "name": "quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64", "product": { "name": "quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64", "product_id": "quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.6.0-62" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64 as a component of Quay v3", "product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64" }, "product_reference": "quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "relates_to_product_reference": "8Base-Quay-3" }, { "category": "default_component_of", "full_product_name": { "name": "quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64 as a component of Quay v3", "product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64" }, "product_reference": "quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "relates_to_product_reference": "8Base-Quay-3" }, { "category": "default_component_of", "full_product_name": { "name": "quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64 as a component of Quay v3", "product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64" }, "product_reference": "quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "relates_to_product_reference": "8Base-Quay-3" }, { "category": "default_component_of", "full_product_name": { "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64 as a component of Quay v3", "product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64" }, "product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "relates_to_product_reference": "8Base-Quay-3" }, { "category": "default_component_of", "full_product_name": { "name": "quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64 as a component of Quay v3", "product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64" }, "product_reference": "quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "relates_to_product_reference": "8Base-Quay-3" }, { "category": "default_component_of", "full_product_name": { "name": "quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64 as a component of Quay v3", "product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64" }, "product_reference": "quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "relates_to_product_reference": "8Base-Quay-3" }, { "category": "default_component_of", "full_product_name": { "name": "quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64 as a component of Quay v3", "product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64" }, "product_reference": "quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "relates_to_product_reference": "8Base-Quay-3" }, { "category": "default_component_of", "full_product_name": { "name": "quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64 as a component of Quay v3", "product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64" }, "product_reference": "quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "relates_to_product_reference": "8Base-Quay-3" }, { "category": "default_component_of", "full_product_name": { "name": "quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64 as a component of Quay v3", "product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" }, "product_reference": "quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "relates_to_product_reference": "8Base-Quay-3" }, { "category": "default_component_of", "full_product_name": { "name": "quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64 as a component of Quay v3", "product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" }, "product_reference": "quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64", "relates_to_product_reference": "8Base-Quay-3" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-16137", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2017-09-27T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1500705" } ], "notes": [ { "category": "description", "text": "The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-debug: Regular expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of rh-nodejs4-nodejs-debug, rh-nodejs6-nodejs-debug, and rh-nodejs8-nodejs-debug as shipped with Red Hat Software Collections 3. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.\n\nRed Hat Virtualization 4.2 EUS includes a vulnerable version of nodejs-debug as a part of the ovirt-engine-api-explorer package. This package is removed in Red Hat Virtualization 4.3.\n\nRed Hat Quay includes the debug library as a dependency of karma-webpack. It is only used at build time, and not runtime so its impact is reduce to low in Red Hat Quay.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-16137" }, { "category": "external", "summary": "RHBZ#1500705", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500705" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-16137", "url": "https://www.cve.org/CVERecord?id=CVE-2017-16137" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-16137", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16137" } ], "release_date": "2017-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-debug: Regular expression Denial of Service" }, { "cve": "CVE-2017-16138", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2017-09-27T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1500700" } ], "notes": [ { "category": "description", "text": "The mime module is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-mime: Regular expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contained a vulnerable version of nodejs-mime in the ovirt-engine-dashboard package. This package has been removed in Red Hat Virtualization 4.2.\n\nRed Hat Quay includes mime as a dependency of Karma. It\u0027s only used at build time, not runtime so this vulnerability has a low impact of Red Hat Quay.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-16138" }, { "category": "external", "summary": "RHBZ#1500700", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500700" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-16138", "url": "https://www.cve.org/CVERecord?id=CVE-2017-16138" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-16138", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16138" }, { "category": "external", "summary": "https://nodesecurity.io/advisories/535", "url": "https://nodesecurity.io/advisories/535" } ], "release_date": "2017-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-mime: Regular expression Denial of Service" }, { "cve": "CVE-2018-1107", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-02-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1546357" } ], "notes": [ { "category": "description", "text": "It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat Quay the is-my-json-valid library is included as a build time dependency of protractor. It\u0027s only used at build time, not at runtime reducing the impact to low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-1107" }, { "category": "external", "summary": "RHBZ#1546357", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1546357" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1107", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1107" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1107", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1107" }, { "category": "external", "summary": "https://snyk.io/vuln/npm:is-my-json-valid:20180214", "url": "https://snyk.io/vuln/npm:is-my-json-valid:20180214" } ], "release_date": "2018-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format" }, { "cve": "CVE-2018-1109", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-02-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1547272" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in nodejs-braces. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks. The highest threat from this vulnerability is system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay includes braces as a dependency of webpack. Braces is only used at build time, not at runtime, reducing the impact of this vulnerability to low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-1109" }, { "category": "external", "summary": "RHBZ#1547272", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547272" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1109", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1109" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1109", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1109" }, { "category": "external", "summary": "https://snyk.io/vuln/npm:braces:20180219", "url": "https://snyk.io/vuln/npm:braces:20180219" } ], "release_date": "2018-02-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js" }, { "cve": "CVE-2018-3721", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2018-02-15T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1545884" } ], "notes": [ { "category": "description", "text": "lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.", "title": "Vulnerability description" }, { "category": "summary", "text": "lodash: Prototype pollution in utilities function", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat CloudForms version 4.7 does not ship component lodash, so isn\u0027t affected by this flaw.\n\nRed Hat Virtualization 4.2 EUS includes a vulnerable version of lodash as part of the ovirt-engine-dashboard package. This package has been removed from Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-3721" }, { "category": "external", "summary": "RHBZ#1545884", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1545884" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-3721", "url": "https://www.cve.org/CVERecord?id=CVE-2018-3721" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-3721", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3721" } ], "release_date": "2018-02-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "lodash: Prototype pollution in utilities function" }, { "cve": "CVE-2018-3728", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2018-02-15T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1545893" } ], "notes": [ { "category": "description", "text": "hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via \u0027merge\u0027 and \u0027applyToDefaults\u0027 functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.", "title": "Vulnerability description" }, { "category": "summary", "text": "hoek: Prototype pollution in utilities function", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay includes hoek as a dependency of protractor which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-3728" }, { "category": "external", "summary": "RHBZ#1545893", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1545893" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-3728", "url": "https://www.cve.org/CVERecord?id=CVE-2018-3728" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-3728", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3728" } ], "release_date": "2018-02-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "hoek: Prototype pollution in utilities function" }, { "cve": "CVE-2018-3774", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2018-08-15T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1940759" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-url-parse. The wrong hostname can be returned, due to incorrect parsing, which can lead to a variety of vulnerabilities. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-url-parse: incorrect hostname in url parsing", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-3774" }, { "category": "external", "summary": "RHBZ#1940759", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940759" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-3774", "url": "https://www.cve.org/CVERecord?id=CVE-2018-3774" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-3774", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3774" } ], "release_date": "2018-07-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nodejs-url-parse: incorrect hostname in url parsing" }, { "cve": "CVE-2018-16492", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2018-07-25T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1608140" } ], "notes": [ { "category": "description", "text": "A prototype pollution vulnerability was found in module extend \u003c2.0.2, ~\u003c3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-extend: Prototype pollution can allow attackers to modify object properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay includes \u0027extend\u0027 as a build time dependency. It\u0027s not used at runtime reducing the impact of this vulnerability to low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16492" }, { "category": "external", "summary": "RHBZ#1608140", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1608140" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16492", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16492" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16492", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16492" }, { "category": "external", "summary": "https://snyk.io/vuln/npm:extend:20180424", "url": "https://snyk.io/vuln/npm:extend:20180424" } ], "release_date": "2018-04-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-extend: Prototype pollution can allow attackers to modify object properties" }, { "cve": "CVE-2018-21270", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-12-04T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1927293" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-stringstream. Node.js stringstream module is vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay include stringstream as a dependency of Karma. Karma is only used at build time, and not at runtime reducing the impact of this vulnerability to low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-21270" }, { "category": "external", "summary": "RHBZ#1927293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-21270", "url": "https://www.cve.org/CVERecord?id=CVE-2018-21270" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-21270", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-21270" } ], "release_date": "2020-05-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure" }, { "cve": "CVE-2019-20920", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-09-18T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1882260" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to arbitrary code execution. The package lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript into the system. This issue is used to run arbitrary code in a server processing Handlebars templates or on a victim\u0027s browser (effectively serving as Cross-Site Scripting). The highest threat from this vulnerability is to confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay includes Handlebars.js as a development dependency. It does not use Handlebars.js at runtime to process templates, so it has been given a low impact rating.\n\nRed Hat Virtualization includes Handlebars.js in two components. In ovirt-engine-ui-extentions, the version used is newer and is not affected by this flaw. In ovirt-web-ui, Handlebars.js is included as a development dependency and is not used at runtime to process templates, so it has been given a low impact rating.\n\nRed Hat OpenShift Container Platform (OCP) 4 delivers the kibana package, which includes Handlebars.js. From OCP 4.6, the kibana package is no longer shipped and will not be fixed. The openshift4/ose-logging-kibana6 container includes Handlebars.js directly as container first code. The vulnerable version of Handlebars.js is also included in openshift4/ose-grafana, but as the Grafana instance is in read-only mode, the configuration/dashboards cannot be modified.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-20920" }, { "category": "external", "summary": "RHBZ#1882260", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882260" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-20920", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20920" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1316", "url": "https://www.npmjs.com/advisories/1316" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1324", "url": "https://www.npmjs.com/advisories/1324" } ], "release_date": "2019-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution" }, { "cve": "CVE-2019-20922", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-09-18T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1882256" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to a denial of service. The package\u0027s parser may be forced into an endless loop while processing specially-crafted templates. This flaw allows attackers to exhaust system resources, leading to a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay includes Handlebars.js as a development dependency. It does not use Handlebars.js at runtime to process templates, so it has been given a low impact rating.\n\nRed Hat Virtualization includes Handlebars.js in two components. In ovirt-engine-ui-extentions, the version used is newer and not affected by this flaw. In the ovirt-web-ui,Handlebars.js is included as a development dependency and is not used at runtime to process templates, so it has been given a low impact rating.\n\nRed Hat OpenShift Container Platform (OCP) 4 delivers the kibana package, which includes Handlebars.js. From OCP 4.6, the kibana package is no longer shipped and will not be fixed. The openshift4/ose-logging-kibana6 container includes Handlebars.js directly as container first code. The vulnerable version of Handlebars.js is also included in openshift4/ose-grafana, but as the Grafana instance is in read-only mode, the configuration/dashboards cannot be modified.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-20922" }, { "category": "external", "summary": "RHBZ#1882256", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882256" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-20922", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20922" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20922", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20922" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1300", "url": "https://www.npmjs.com/advisories/1300" } ], "release_date": "2019-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS" }, { "cve": "CVE-2019-1010266", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-07-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743096" } ], "notes": [ { "category": "description", "text": "lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.", "title": "Vulnerability description" }, { "category": "summary", "text": "lodash: uncontrolled resource consumption in Data handler causing denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1010266" }, { "category": "external", "summary": "RHBZ#1743096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743096" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1010266", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1010266" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010266", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010266" } ], "release_date": "2019-04-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "lodash: uncontrolled resource consumption in Data handler causing denial of service" }, { "cve": "CVE-2020-7608", "cwe": { "id": "CWE-267", "name": "Privilege Defined With Unsafe Actions" }, "discovery_date": "2020-05-11T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1840004" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-yargs-parser: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7608" }, { "category": "external", "summary": "RHBZ#1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7608", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7608" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608" } ], "release_date": "2020-03-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-yargs-parser: prototype pollution vulnerability" }, { "cve": "CVE-2020-8203", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-07-15T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1857412" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-lodash: prototype pollution in zipObjectDeep function", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift ServiceMesh (OSSM), Red Hat OpenShift Jaeger (RHOSJ) and Red Hat OpenShift Container Platform (RHOCP), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-lodash library to authenticated users only, therefore the impact is low.\n\nRed Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-lodash library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future.\n\nRed Hat Virtualization uses vulnerable version of nodejs-lodash, however zipObjectDeep is not used, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8203" }, { "category": "external", "summary": "RHBZ#1857412", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857412" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8203", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8203" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8203", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8203" }, { "category": "external", "summary": "https://hackerone.com/reports/712065", "url": "https://hackerone.com/reports/712065" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1523", "url": "https://www.npmjs.com/advisories/1523" } ], "release_date": "2020-04-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-lodash: prototype pollution in zipObjectDeep function" }, { "cve": "CVE-2020-15366", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-07-15T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1857977" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-ajv library to authenticated users only, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15366" }, { "category": "external", "summary": "RHBZ#1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15366", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15366" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-AJV-584908", "url": "https://snyk.io/vuln/SNYK-JS-AJV-584908" } ], "release_date": "2020-07-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function" }, { "cve": "CVE-2020-26237", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-11-24T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1901662" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-highlight-js. Highlight.js is vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object\u0027s prototype during highlighting.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-highlight-js: prototype pollution via a crafted HTML code block", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat Virtualization, ovirt-engine-api-explorer uses a vulnerable version of highlight.js, however since release 4.4.3 ovirt-engine-api-explorer is obsoleted and no longer used.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-26237" }, { "category": "external", "summary": "RHBZ#1901662", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901662" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-26237", "url": "https://www.cve.org/CVERecord?id=CVE-2020-26237" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-26237", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26237" }, { "category": "external", "summary": "https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx", "url": "https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx" } ], "release_date": "2020-11-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-highlight-js: prototype pollution via a crafted HTML code block" }, { "cve": "CVE-2020-26291", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2021-01-12T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1915257" } ], "notes": [ { "category": "description", "text": "A flaw was found in urijs. The hostname can be spoofed by using a backslash (`\\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.", "title": "Vulnerability description" }, { "category": "summary", "text": "urijs: Hostname spoofing via backslashes in URL", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-26291" }, { "category": "external", "summary": "RHBZ#1915257", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915257" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-26291", "url": "https://www.cve.org/CVERecord?id=CVE-2020-26291" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-26291", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26291" }, { "category": "external", "summary": "https://github.com/medialize/URI.js/commit/b02bf037c99ac9316b77ff8bfd840e90becf1155", "url": "https://github.com/medialize/URI.js/commit/b02bf037c99ac9316b77ff8bfd840e90becf1155" }, { "category": "external", "summary": "https://github.com/medialize/URI.js/releases/tag/v1.19.4", "url": "https://github.com/medialize/URI.js/releases/tag/v1.19.4" }, { "category": "external", "summary": "https://github.com/medialize/URI.js/security/advisories/GHSA-3329-pjwv-fjpg", "url": "https://github.com/medialize/URI.js/security/advisories/GHSA-3329-pjwv-fjpg" }, { "category": "external", "summary": "https://www.npmjs.com/package/urijs", "url": "https://www.npmjs.com/package/urijs" } ], "release_date": "2020-12-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "urijs: Hostname spoofing via backslashes in URL" }, { "cve": "CVE-2020-35653", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2021-01-12T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1915420" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. The PcxDecode in Pillow has a buffer over-read when decoding a crafted PCX file due to the user-supplied stride value trusted for buffer calculations. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Buffer over-read in PCX image reader", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-35653" }, { "category": "external", "summary": "RHBZ#1915420", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915420" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-35653", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35653" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-35653", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35653" }, { "category": "external", "summary": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security", "url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security" } ], "release_date": "2021-01-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "python-pillow: Buffer over-read in PCX image reader" }, { "cve": "CVE-2020-35654", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2021-01-12T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1915424" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow", "title": "Vulnerability summary" }, { "category": "other", "text": "python-pillow as shipped with Red Hat Enterprise Linux 7 and 8 are not affected by this flaw as the flaw was introduced in a newer version than shipped.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-35654" }, { "category": "external", "summary": "RHBZ#1915424", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915424" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-35654", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35654" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-35654", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35654" }, { "category": "external", "summary": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security", "url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security" } ], "release_date": "2021-01-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow" }, { "cve": "CVE-2021-23364", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-04-30T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1955619" } ], "notes": [ { "category": "description", "text": "Regular Expression Denial of Service (ReDoS) vulnerability was found in browserslist library. An attacker can use this vulnerability to parse a query which potentially can lead to service degradation.", "title": "Vulnerability description" }, { "category": "summary", "text": "browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS)", "title": "Vulnerability summary" }, { "category": "other", "text": "While some components do package a vulnerable version of nodejs browserslist library, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. \nThis applies to the following products:\n - OpenShift Container Platform (OCP)\n - OpenShift ServiceMesh (OSSM)\n - Red Hat Advanced Cluster Management for Kubernetes (RHACM)\n\nIn Red Had Quay , whilst a vulnerable version of `browserslist` is included in the quay-rhel8 container it is a development dependency only, therefor the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-23364" }, { "category": "external", "summary": "RHBZ#1955619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-23364", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-23364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23364" } ], "release_date": "2021-04-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS)" }, { "cve": "CVE-2021-23368", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-04-12T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1948763" } ], "notes": [ { "category": "description", "text": "A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss`. When parsing a supplied CSS string, if it contains an unexpected value then as the supplied CSS grows in length it will take an ever increasing amount of time to process. An attacker can use this vulnerability to potentially craft a malicious a long CSS value to process resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-postcss: Regular expression denial of service during source map parsing", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat OpenShift Container Platform (RHOCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-postcss library to authenticated users only, therefore the impact is low.\n\nRed Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-postcss library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future.\n\nIn Red Had Quay , whilst a vulnerable version of `postcss` is included in the quay-rhel8 container it is a development dependency only, therefor the impact is low.\n\nIn Red Hat Virtualization a vulnerable version of postcss is used in cockpit-ovirt, ovirt-web-ui and ovirt-engine-ui-extensions. However, it is only used during development and is used to process known CSS content. This flaw has been marked as \"wontfix\" and it may be addressed in future updates.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-23368" }, { "category": "external", "summary": "RHBZ#1948763", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1948763" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-23368", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23368" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-23368", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23368" } ], "release_date": "2021-04-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-postcss: Regular expression denial of service during source map parsing" }, { "cve": "CVE-2021-23382", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-04-26T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1954150" } ], "notes": [ { "category": "description", "text": "A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss` when using getAnnotationURL() or loadAnnotation() options in lib/previous-map.js. An attacker can use this vulnerability to potentially craft a malicious CSS to process resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat OpenShift Container Platform (RHOCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-postcss library to authenticated users only, therefore the impact is low.\n\nRed Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-postcss library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future.\n\nIn Red Had Quay , whilst a vulnerable version of `postcss` is included in the quay-rhel8 container it is a development dependency only, therefor the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-23382" }, { "category": "external", "summary": "RHBZ#1954150", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954150" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-23382", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23382" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-23382", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23382" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640", "url": "https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640" } ], "release_date": "2021-04-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js" }, { "cve": "CVE-2021-25289", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2021-03-01T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1934680" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. The previous fix for CVE-2020-35654 was insufficient due to incorrect error checking in TiffDecode.c. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c", "title": "Vulnerability summary" }, { "category": "other", "text": "python-pillow as shipped with Red Hat Enterprise Linux 7 and 8 are not affected by this flaw as the flaw was introduced in a newer version than shipped.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-25289" }, { "category": "external", "summary": "RHBZ#1934680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934680" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-25289", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25289" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25289", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25289" } ], "release_date": "2021-02-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" }, { "category": "workaround", "details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c" }, { "cve": "CVE-2021-25290", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2021-03-01T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1934685" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. In TiffDecode.c, there is a negative-offset memcpy with an invalid size which could lead to a system crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Negative-offset memcpy in TIFF image reader", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-25290" }, { "category": "external", "summary": "RHBZ#1934685", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934685" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-25290", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25290" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25290", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25290" } ], "release_date": "2021-02-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" }, { "category": "workaround", "details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-pillow: Negative-offset memcpy in TIFF image reader" }, { "cve": "CVE-2021-25291", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2021-03-01T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1934692" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. Invalid tile boundaries could lead to an OOB Read in TiffReadRGBATile in TiffDecode.c.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue does not affect the versions of python-pillow as shipped with Red Hat Enterprise Linux 8 as it does not include the vulnerable code, which was introduced in a newer upstream version than what what shipped.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-25291" }, { "category": "external", "summary": "RHBZ#1934692", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934692" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-25291", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25291" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25291", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25291" } ], "release_date": "2021-02-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" }, { "category": "workaround", "details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c" }, { "cve": "CVE-2021-25292", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2021-03-01T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1934699" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. The PDF parser has a catastrophic backtracking regex that could be used as a DOS attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Regular expression DoS in PDF format parser", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-25292" }, { "category": "external", "summary": "RHBZ#1934699", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934699" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-25292", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25292" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25292", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25292" } ], "release_date": "2021-02-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" }, { "category": "workaround", "details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-pillow: Regular expression DoS in PDF format parser" }, { "cve": "CVE-2021-25293", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2021-03-01T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1934705" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. There is an Out of Bounds Read in SGIRleDecode.c.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Out-of-bounds read in SGI RLE image reader", "title": "Vulnerability summary" }, { "category": "other", "text": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-25293" }, { "category": "external", "summary": "RHBZ#1934705", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934705" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-25293", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25293" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25293", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25293" } ], "release_date": "2021-02-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-pillow: Out-of-bounds read in SGI RLE image reader" }, { "cve": "CVE-2021-27515", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2021-03-03T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1934474" } ], "notes": [ { "category": "description", "text": "An input validation flaw exists in the node.js-url-parse, which results in the URL being incorrectly set to the document location protocol instead of the URL being passed as an argument. This flaw allows an attacker to bypass security checks on URLs. The highest threat from this vulnerability is to integrity. This is an incomplete fix for CVE-2020-8124.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-27515" }, { "category": "external", "summary": "RHBZ#1934474", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934474" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-27515", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27515" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27515", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27515" } ], "release_date": "2021-02-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise" }, { "cve": "CVE-2021-27516", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2021-03-03T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1934470" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-urijs where URI.js (urijs) mishandles certain uses of the backslash such as http:\\/ and interprets the URI as a relative path. The highest threat from this vulnerability is to confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay includes the urijs dependency in it\u0027s package.lock file but it\u0027s not used anywhere in the code.\n\nRed Hat Advanced Cluster Management for Kubernetes uses Quay as a service, but not code from Quay that exists in RHACM.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-27516" }, { "category": "external", "summary": "RHBZ#1934470", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934470" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-27516", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27516" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27516" } ], "release_date": "2021-02-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise" }, { "cve": "CVE-2021-27921", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-03-03T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1935384" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Excessive memory allocation in BLP image reader", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-27921" }, { "category": "external", "summary": "RHBZ#1935384", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935384" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-27921", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27921" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27921", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27921" } ], "release_date": "2021-03-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" }, { "category": "workaround", "details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-pillow: Excessive memory allocation in BLP image reader" }, { "cve": "CVE-2021-27922", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-03-03T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1935396" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Excessive memory allocation in ICNS image reader", "title": "Vulnerability summary" }, { "category": "other", "text": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-27922" }, { "category": "external", "summary": "RHBZ#1935396", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935396" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-27922", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27922" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27922", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27922" } ], "release_date": "2021-03-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-pillow: Excessive memory allocation in ICNS image reader" }, { "cve": "CVE-2021-27923", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-03-03T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1935401" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Excessive memory allocation in ICO image reader", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-27923" }, { "category": "external", "summary": "RHBZ#1935401", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935401" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-27923", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27923" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27923", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27923" } ], "release_date": "2021-03-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" }, { "category": "workaround", "details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-pillow: Excessive memory allocation in ICO image reader" }, { "cve": "CVE-2021-34552", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2021-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1982378" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-pillow. This flaw allows an attacker to pass controlled parameters directly into a convert function, triggering a buffer overflow in the \"convert()\" or \"ImagingConvertTransparent()\" functions in Convert.c. The highest threat to this vulnerability is to system availability.\r\n\r\nIn Red Hat Quay, a vulnerable version of python-pillow is shipped with quay-registry-container, however the invoice generation feature which uses python-pillow is disabled by default. Therefore impact has been rated Moderate.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Buffer overflow in image convert function", "title": "Vulnerability summary" }, { "category": "other", "text": "Due to the compiler options used, the buffer overflow is detected and the impact is lowered to a crash only. Additionally, the \"mode\" parameter has to be attacker controlled, which is considered a rare case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "known_not_affected": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-34552" }, { "category": "external", "summary": "RHBZ#1982378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982378" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-34552", "url": "https://www.cve.org/CVERecord?id=CVE-2021-34552" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-34552", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34552" }, { "category": "external", "summary": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow", "url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow" } ], "release_date": "2021-07-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:3917" }, { "category": "workaround", "details": "To mitigate this flaw on Red Hat Quay, keep the invoice generation feature disabled, as it is by default.\n\nRed Hat Satellite 6.9 customers can apply following hotfix to eliminate the vulnerability warnings.\n* Download python2-daemon-2.1.2-7.1.HFRHBZ1998199.el7sat.noarch.rpm from https://bugzilla.redhat.com/attachment.cgi?id=1819471\n* Stop services:\n# satellite-maintain service stop\n* Upgrade python2-daemon and remove affected package\n# rpm -Uvh python2-daemon-2.1.2-7.1.HFRHBZ1998199.el7sat.noarch.rpm\n# yum remove python-pillow\n* Restart services:\n# satellite-maintain service start\n\nSatellite 6.10 future release is also fixing this.", "product_ids": [ "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64", "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64", "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64", "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64", "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64", "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64", "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64", "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64", "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64", "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-pillow: Buffer overflow in image convert function" } ] }
rhsa-2020_5305
Vulnerability from csaf_redhat
Published
2020-12-01 14:49
Modified
2024-11-05 23:03
Summary
Red Hat Security Advisory: rh-nodejs12-nodejs security update
Notes
Topic
An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.19.1).
Security Fix(es):
* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.19.1).\n\nSecurity Fix(es):\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:5305", "url": "https://access.redhat.com/errata/RHSA-2020:5305" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "1898554", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898554" }, { "category": "external", "summary": "1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5305.json" } ], "title": "Red Hat Security Advisory: rh-nodejs12-nodejs security update", "tracking": { "current_release_date": "2024-11-05T23:03:33+00:00", "generator": { "date": "2024-11-05T23:03:33+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2020:5305", "initial_release_date": "2020-12-01T14:49:32+00:00", "revision_history": [ { "date": "2020-12-01T14:49:32+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-12-01T14:49:32+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T23:03:33+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.19.1-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.19.1-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "product": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "product_id": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.8-12.19.1.2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.19.1-2.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "product_id": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.19.1-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "product_id": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.19.1-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "product": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "product_id": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.8-12.19.1.2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.19.1-2.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "product_id": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.19.1-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "product_id": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.19.1-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "product": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "product_id": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.8-12.19.1.2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.19.1-2.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "product": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "product_id": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.19.1-2.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "product": { "name": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "product_id": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-docs@12.19.1-2.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7608", "cwe": { "id": "CWE-267", "name": "Privilege Defined With Unsafe Actions" }, "discovery_date": "2020-05-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1840004" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-yargs-parser: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7608" }, { "category": "external", "summary": "RHBZ#1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7608", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7608" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608" } ], "release_date": "2020-03-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-01T14:49:32+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5305" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-yargs-parser: prototype pollution vulnerability" }, { "cve": "CVE-2020-7774", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2020-11-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1898680" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n\u0027s locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-y18n: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and OpenShift distributed tracing the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-y18n library to authenticated users only, therefore the impact is Low.\n\nIn Red Hat OpenShift Container Storage 4 the noobaa-core container includes the affected version of y18n as a dependency of yargs. However, no unsafe usage found where the module accepts untrusted input and hence this issue has been rated as having a security impact of Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7774" }, { "category": "external", "summary": "RHBZ#1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7774", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7774" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887", "url": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887" } ], "release_date": "2020-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-01T14:49:32+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5305" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-y18n: prototype pollution vulnerability" }, { "cve": "CVE-2020-8277", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2020-11-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1898554" } ], "notes": [ { "category": "description", "text": "A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions \u003c 15.2.1, \u003c 14.15.1, and \u003c 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8277" }, { "category": "external", "summary": "RHBZ#1898554", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898554" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8277", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8277" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8277", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8277" } ], "release_date": "2020-11-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-01T14:49:32+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5305" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS" }, { "cve": "CVE-2020-15366", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1857977" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-ajv library to authenticated users only, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15366" }, { "category": "external", "summary": "RHBZ#1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15366", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15366" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-AJV-584908", "url": "https://snyk.io/vuln/SNYK-JS-AJV-584908" } ], "release_date": "2020-07-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-01T14:49:32+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5305" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-debuginfo-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-devel-0:12.19.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs12-nodejs-docs-0:12.19.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs12-npm-0:6.14.8-12.19.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function" } ] }
rhsa-2021_0548
Vulnerability from csaf_redhat
Published
2021-02-16 14:25
Modified
2024-11-05 23:17
Summary
Red Hat Security Advisory: nodejs:10 security update
Notes
Topic
An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (10.23.1).
Security Fix(es):
* libuv: buffer overflow in realpath (CVE-2020-8252)
* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs-dot-prop: prototype pollution (CVE-2020-8116)
* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
* npm: sensitive information exposure through logs (CVE-2020-15095)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2021:0548", "url": "https://access.redhat.com/errata/RHSA-2021:0548" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "1892430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892430" }, { "category": "external", "summary": "1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "1912854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912854" }, { "category": "external", "summary": "1912863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912863" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0548.json" } ], "title": "Red Hat Security Advisory: nodejs:10 security update", "tracking": { "current_release_date": "2024-11-05T23:17:03+00:00", "generator": { "date": "2024-11-05T23:17:03+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2021:0548", "initial_release_date": "2021-02-16T14:25:46+00:00", "revision_history": [ { "date": "2021-02-16T14:25:46+00:00", "number": "1", "summary": "Initial version" }, { "date": "2021-02-16T14:25:46+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T23:17:03+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:10:8030020210118191659:229f0a1c", "product": { "name": "nodejs:10:8030020210118191659:229f0a1c", "product_id": "nodejs:10:8030020210118191659:229f0a1c", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@10:8030020210118191659:229f0a1c" } } }, { "category": "product_version", "name": "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "product": { "name": "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "product_id": "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8%2B2632%2B6c5111ed?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8%2B2873%2Baa7dfd9a?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "product": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "product_id": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8%2B2632%2B6c5111ed?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "product_id": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8%2B2873%2Baa7dfd9a?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, "product_reference": "nodejs:10:8030020210118191659:229f0a1c", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src" }, "product_reference": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch" }, "product_reference": "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7608", "cwe": { "id": "CWE-267", "name": "Privilege Defined With Unsafe Actions" }, "discovery_date": "2020-05-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1840004" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-yargs-parser: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7608" }, { "category": "external", "summary": "RHBZ#1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7608", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7608" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608" } ], "release_date": "2020-03-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-yargs-parser: prototype pollution vulnerability" }, { "cve": "CVE-2020-7754", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1892430" } ], "notes": [ { "category": "description", "text": "This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat Enterprise Linux 8 and Software Collections, `npm-user-validate` is used exclusively for `npm`. As a result, this vulnerability is considered Low in such a context.\n\nIn OpenShift Container Platform (OCP) 3.11 and 4.4 the kibana package has been marked Low (similar to RHEL8) as it is primarily used for npm and is protected via OpenShift OAuth. Additionally, whilst OCP 4.4 does deliver the kibana package, due to the code changing to container first content, it has been marked as wontfix at this time and may be fixed in a future release. \n\nAdditionally, the openshift4/ose-logging-kibana6 container is not represented on the CVE page as it gets npm from the Red Hat Software Collections and as such the ose-logging-kibana6 container will be updated when the rh-nodejs10-nodejs package is.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7754" }, { "category": "external", "summary": "RHBZ#1892430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892430" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7754", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7754" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7754", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7754" }, { "category": "external", "summary": "https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p", "url": "https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p" } ], "release_date": "2020-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS" }, { "cve": "CVE-2020-7774", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2020-11-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1898680" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n\u0027s locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-y18n: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and OpenShift distributed tracing the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-y18n library to authenticated users only, therefore the impact is Low.\n\nIn Red Hat OpenShift Container Storage 4 the noobaa-core container includes the affected version of y18n as a dependency of yargs. However, no unsafe usage found where the module accepts untrusted input and hence this issue has been rated as having a security impact of Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7774" }, { "category": "external", "summary": "RHBZ#1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7774", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7774" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887", "url": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887" } ], "release_date": "2020-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-y18n: prototype pollution vulnerability" }, { "cve": "CVE-2020-7788", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-12-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1907444" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ini: Prototype pollution via malicious INI file", "title": "Vulnerability summary" }, { "category": "other", "text": "Node.JS packages in Red Hat Enterprise Linux and Red Hat Software Collections included the vulnerable dependency packaged in \"nodejs-npm\" component. Processing malicious files using npm could potentially trigger this vulnerability. The \"ini\" package bundled with npm was not in the library path where it could be included directly in other programs.\n\nThe nodejs-nodemon packages in Red Hat Enterprise Linux and Red Hat Software Collections are affected by this vulnerability as they bundle the nodejs-ini library. Usage of that library is governed by nodemon itself, so applications started by nodemon are not impacted. Further, nodemon is a developer tool not intended to be used in production.\n\nThe ini package is included in Red Hat Quay by protractor and webpack-cli, both of which are dev dependencies.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7788" }, { "category": "external", "summary": "RHBZ#1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7788", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7788" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788" } ], "release_date": "2020-12-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ini: Prototype pollution via malicious INI file" }, { "cve": "CVE-2020-8116", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-08-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1868196" } ], "notes": [ { "category": "description", "text": "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-dot-prop: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8116" }, { "category": "external", "summary": "RHBZ#1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8116", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8116" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116" }, { "category": "external", "summary": "https://hackerone.com/reports/719856", "url": "https://hackerone.com/reports/719856" } ], "release_date": "2020-01-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-dot-prop: prototype pollution" }, { "cve": "CVE-2020-8252", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-09-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1879315" } ], "notes": [ { "category": "description", "text": "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "libuv: buffer overflow in realpath", "title": "Vulnerability summary" }, { "category": "other", "text": "As shipped in Red Hat Software Collections (nodejs-10 \u0026 nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8252" }, { "category": "external", "summary": "RHBZ#1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8252", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8252" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libuv: buffer overflow in realpath" }, { "cve": "CVE-2020-8265", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2021-01-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1912854" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: use-after-free in the TLS implementation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8265" }, { "category": "external", "summary": "RHBZ#1912854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912854" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8265", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8265" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8265", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8265" }, { "category": "external", "summary": "https://hackerone.com/reports/988103", "url": "https://hackerone.com/reports/988103" } ], "release_date": "2021-01-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: use-after-free in the TLS implementation" }, { "cve": "CVE-2020-8287", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-01-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1912863" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP request smuggling via two copies of a header field in an http request", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8287" }, { "category": "external", "summary": "RHBZ#1912863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912863" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8287", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8287" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8287", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8287" } ], "release_date": "2021-01-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: HTTP request smuggling via two copies of a header field in an http request" }, { "cve": "CVE-2020-15095", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2020-07-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1856875" } ], "notes": [ { "category": "description", "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.", "title": "Vulnerability description" }, { "category": "summary", "text": "npm: sensitive information exposure through logs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15095" }, { "category": "external", "summary": "RHBZ#1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15095", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15095" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095" } ], "release_date": "2020-07-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" }, { "category": "workaround", "details": "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm: sensitive information exposure through logs" }, { "cve": "CVE-2020-15366", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1857977" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-ajv library to authenticated users only, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15366" }, { "category": "external", "summary": "RHBZ#1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15366", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15366" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-AJV-584908", "url": "https://snyk.io/vuln/SNYK-JS-AJV-584908" } ], "release_date": "2020-07-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function" } ] }
rhsa-2020_5499
Vulnerability from csaf_redhat
Published
2020-12-15 17:27
Modified
2024-11-05 23:06
Summary
Red Hat Security Advisory: nodejs:12 security and bug fix update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:5499", "url": "https://access.redhat.com/errata/RHSA-2020:5499" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "1898554", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898554" }, { "category": "external", "summary": "1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5499.json" } ], "title": "Red Hat Security Advisory: nodejs:12 security and bug fix update", "tracking": { "current_release_date": "2024-11-05T23:06:32+00:00", "generator": { "date": "2024-11-05T23:06:32+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2020:5499", "initial_release_date": "2020-12-15T17:27:36+00:00", "revision_history": [ { "date": "2020-12-15T17:27:36+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-12-15T17:27:36+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T23:06:32+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8030020201124152102:229f0a1c", "product": { "name": "nodejs:12:8030020201124152102:229f0a1c", "product_id": "nodejs:12:8030020201124152102:229f0a1c", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8030020201124152102:229f0a1c" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "product": { "name": "nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "product_id": "nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "product": { "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "product_id": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product": { "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_id": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product": { "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_id": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product": { "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_id": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product": { "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_id": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product": { "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_id": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64", "product": { "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_id": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.8-1.12.19.1.1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product": { "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product_id": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product": { "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product_id": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product": { "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product_id": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product": { "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product_id": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product": { "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product_id": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "product": { "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "product_id": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.8-1.12.19.1.1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product": { "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_id": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_id": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product": { "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_id": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product": { "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_id": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_id": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product": { "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_id": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.8-1.12.19.1.1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product": { "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_id": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product": { "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_id": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product": { "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_id": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product": { "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_id": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product": { "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_id": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "product": { "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_id": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.8-1.12.19.1.1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, "product_reference": "nodejs:12:8030020201124152102:229f0a1c", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64" }, "product_reference": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le" }, "product_reference": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x" }, "product_reference": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src" }, "product_reference": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64" }, "product_reference": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64" }, "product_reference": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x" }, "product_reference": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64" }, "product_reference": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x" }, "product_reference": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64" }, "product_reference": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64" }, "product_reference": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le" }, "product_reference": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x" }, "product_reference": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64" }, "product_reference": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch" }, "product_reference": "nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64" }, "product_reference": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x" }, "product_reference": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64" }, "product_reference": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le" }, "product_reference": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x" }, "product_reference": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" }, "product_reference": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7608", "cwe": { "id": "CWE-267", "name": "Privilege Defined With Unsafe Actions" }, "discovery_date": "2020-05-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1840004" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-yargs-parser: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7608" }, { "category": "external", "summary": "RHBZ#1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7608", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7608" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608" } ], "release_date": "2020-03-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-15T17:27:36+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5499" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-yargs-parser: prototype pollution vulnerability" }, { "cve": "CVE-2020-7774", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2020-11-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1898680" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n\u0027s locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-y18n: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and OpenShift distributed tracing the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-y18n library to authenticated users only, therefore the impact is Low.\n\nIn Red Hat OpenShift Container Storage 4 the noobaa-core container includes the affected version of y18n as a dependency of yargs. However, no unsafe usage found where the module accepts untrusted input and hence this issue has been rated as having a security impact of Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7774" }, { "category": "external", "summary": "RHBZ#1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7774", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7774" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887", "url": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887" } ], "release_date": "2020-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-15T17:27:36+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5499" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-y18n: prototype pollution vulnerability" }, { "cve": "CVE-2020-8277", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2020-11-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1898554" } ], "notes": [ { "category": "description", "text": "A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions \u003c 15.2.1, \u003c 14.15.1, and \u003c 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8277" }, { "category": "external", "summary": "RHBZ#1898554", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898554" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8277", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8277" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8277", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8277" } ], "release_date": "2020-11-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-15T17:27:36+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5499" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS" }, { "cve": "CVE-2020-15366", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1857977" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-ajv library to authenticated users only, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15366" }, { "category": "external", "summary": "RHBZ#1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15366", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15366" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-AJV-584908", "url": "https://snyk.io/vuln/SNYK-JS-AJV-584908" } ], "release_date": "2020-07-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-15T17:27:36+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5499" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function" } ] }
rhsa-2021_2041
Vulnerability from csaf_redhat
Published
2021-05-19 09:14
Modified
2024-11-11 17:47
Summary
Red Hat Security Advisory: Red Hat OpenShift Container Storage 4.7.0 security, bug fix, and enhancement update
Notes
Topic
Updated images which include numerous security fixes, bug fixes, and enhancements are now available for Red Hat OpenShift Container Storage 4.7.0 on Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Storage is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Container Storage is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Container Storage provisions a multicloud data management service with an S3 compatible API.
Security Fix(es):
* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
* kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9 (CVE-2020-8565)
* jwt-go: access restriction bypass vulnerability (CVE-2020-26160)
* nodejs-date-and-time: ReDoS in parsing via date.compile (CVE-2020-26289)
* golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)
* golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)
* NooBaa: noobaa-operator leaking RPC AuthToken into log files (CVE-2021-3528)
* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
This update includes various bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Container Storage Release Notes for information on the most significant of these changes:
https://access.redhat.com/documentation/en-us/red_hat_openshift_container_storage/4.7/html-single/4.7_release_notes/index
All Red Hat OpenShift Container Storage users are advised to upgrade to these updated images.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated images which include numerous security fixes, bug fixes, and enhancements are now available for Red Hat OpenShift Container Storage 4.7.0 on Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Storage is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Container Storage is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Container Storage provisions a multicloud data management service with an S3 compatible API.\n\nSecurity Fix(es):\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \u003e= 9 (CVE-2020-8565)\n\n* jwt-go: access restriction bypass vulnerability (CVE-2020-26160)\n\n* nodejs-date-and-time: ReDoS in parsing via date.compile (CVE-2020-26289)\n\n* golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)\n\n* golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)\n\n* NooBaa: noobaa-operator leaking RPC AuthToken into log files (CVE-2021-3528)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\nThis update includes various bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Container Storage Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_container_storage/4.7/html-single/4.7_release_notes/index\n\nAll Red Hat OpenShift Container Storage users are advised to upgrade to these updated images.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2021:2041", "url": "https://access.redhat.com/errata/RHSA-2021:2041" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1803849", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1803849" }, { "category": "external", "summary": "1814681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814681" }, { "category": "external", "summary": "1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "1850089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850089" }, { "category": "external", "summary": "1860594", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860594" }, { "category": "external", "summary": "1861104", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1861104" }, { "category": "external", "summary": "1861878", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1861878" }, { "category": "external", "summary": "1866301", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1866301" }, { "category": "external", "summary": "1869406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869406" }, { "category": "external", "summary": "1872730", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1872730" }, { "category": "external", "summary": "1874367", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1874367" }, { "category": "external", "summary": "1883371", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883371" }, { "category": "external", "summary": "1886112", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1886112" }, { "category": "external", "summary": "1886416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1886416" }, { "category": "external", "summary": "1886638", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1886638" }, { "category": "external", "summary": "1888839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1888839" }, { "category": "external", "summary": "1892622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892622" }, { "category": "external", "summary": "1893611", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1893611" }, { "category": "external", "summary": "1893613", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1893613" }, { "category": "external", "summary": "1893619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1893619" }, { "category": "external", "summary": "1894412", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1894412" }, { "category": "external", "summary": "1896338", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1896338" }, { "category": "external", "summary": "1897246", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1897246" }, { "category": "external", "summary": "1897635", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1897635" }, { "category": "external", "summary": "1898509", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898509" }, { "category": "external", "summary": "1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "1898808", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898808" }, { "category": "external", "summary": "1900711", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1900711" }, { "category": "external", "summary": "1900722", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1900722" }, { "category": "external", "summary": "1900749", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1900749" }, { "category": "external", "summary": "1900760", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1900760" }, { "category": "external", "summary": "1901134", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901134" }, { "category": "external", "summary": "1902192", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1902192" }, { "category": "external", "summary": "1902685", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1902685" }, { "category": "external", "summary": "1902711", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1902711" }, { "category": "external", "summary": "1903973", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903973" }, { "category": "external", "summary": "1903975", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903975" }, { "category": "external", "summary": "1904302", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1904302" }, { "category": "external", "summary": "1904929", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1904929" }, { "category": "external", "summary": "1907318", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907318" }, { "category": "external", "summary": "1908414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908414" }, { "category": "external", "summary": "1908678", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908678" }, { "category": "external", "summary": "1909268", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909268" }, { "category": "external", "summary": "1909488", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909488" }, { "category": "external", "summary": "1909745", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909745" }, { "category": "external", "summary": "1910705", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1910705" }, { "category": "external", "summary": "1911131", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1911131" }, { "category": "external", "summary": "1911266", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1911266" }, { "category": "external", "summary": "1911627", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1911627" }, { "category": "external", "summary": "1911789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1911789" }, { "category": "external", "summary": "1912421", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912421" }, { "category": "external", "summary": "1912894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912894" }, { "category": "external", "summary": "1913149", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1913149" }, { "category": "external", "summary": "1913357", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1913357" }, { "category": "external", "summary": "1914132", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914132" }, { "category": "external", "summary": "1914159", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914159" }, { "category": "external", "summary": "1914215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914215" }, { "category": "external", "summary": "1915111", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915111" }, { "category": "external", "summary": "1915261", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915261" }, { "category": "external", "summary": "1915445", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915445" }, { "category": "external", "summary": "1915644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915644" }, { "category": "external", "summary": "1915698", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915698" }, { "category": "external", "summary": "1915706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915706" }, { "category": "external", "summary": "1915730", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915730" }, { "category": "external", "summary": "1915737", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915737" }, { "category": "external", "summary": "1915758", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915758" }, { "category": "external", "summary": "1915807", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915807" }, { "category": "external", "summary": "1915851", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915851" }, { "category": "external", "summary": "1915953", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915953" }, { "category": "external", "summary": "1916850", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916850" }, { "category": "external", "summary": "1917253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917253" }, { "category": "external", "summary": "1917815", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917815" }, { "category": "external", "summary": "1918360", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1918360" }, { "category": "external", "summary": "1918750", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1918750" }, { "category": "external", "summary": "1918925", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1918925" }, { "category": "external", "summary": "1918938", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1918938" }, { "category": "external", "summary": "1919967", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1919967" }, { "category": "external", "summary": "1920202", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1920202" }, { "category": "external", "summary": "1920498", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1920498" }, { "category": "external", "summary": "1920507", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1920507" }, { "category": "external", "summary": "1921521", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921521" }, { "category": "external", "summary": "1921540", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921540" }, { "category": "external", "summary": "1921609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921609" }, { "category": "external", "summary": "1921625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921625" }, { "category": "external", "summary": "1922064", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1922064" }, { "category": "external", "summary": "1922108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1922108" }, { "category": "external", "summary": "1922113", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1922113" }, { "category": "external", "summary": "1922119", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1922119" }, { "category": "external", "summary": "1922421", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1922421" }, { "category": "external", "summary": "1922954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1922954" }, { "category": "external", "summary": "1924185", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1924185" }, { "category": "external", "summary": "1924211", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1924211" }, { "category": "external", "summary": "1924634", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1924634" }, { "category": "external", "summary": "1924784", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1924784" }, { "category": "external", "summary": "1924792", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1924792" }, { "category": "external", "summary": "1925055", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1925055" }, { "category": "external", "summary": "1925179", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1925179" }, { "category": "external", "summary": "1925249", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1925249" }, { "category": "external", "summary": "1925533", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1925533" }, { "category": "external", "summary": "1926182", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926182" }, { "category": "external", "summary": "1926617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926617" }, { "category": "external", "summary": "1926717", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926717" }, { "category": "external", "summary": "1926831", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926831" }, { "category": "external", "summary": "1927128", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927128" }, { "category": "external", "summary": "1927138", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927138" }, { "category": "external", "summary": "1927186", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927186" }, { "category": "external", "summary": "1927317", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927317" }, { "category": "external", "summary": "1927330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927330" }, { "category": "external", "summary": "1927338", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927338" }, { "category": "external", "summary": "1927885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927885" }, { "category": "external", "summary": "1928063", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928063" }, { "category": "external", "summary": "1928451", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928451" }, { "category": "external", "summary": "1928471", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928471" }, { "category": "external", "summary": "1928487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928487" }, { "category": "external", "summary": "1928642", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928642" }, { "category": "external", "summary": "1931191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1931191" }, { "category": "external", "summary": "1931810", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1931810" }, { "category": "external", "summary": "1931839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1931839" }, { "category": "external", "summary": "1932400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1932400" }, { "category": "external", "summary": "1933607", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1933607" }, { "category": "external", "summary": "1933609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1933609" }, { "category": "external", "summary": "1933736", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1933736" }, { "category": "external", "summary": "1934000", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934000" }, { "category": "external", "summary": "1934990", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934990" }, { "category": "external", "summary": "1935342", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935342" }, { "category": "external", "summary": "1936545", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1936545" }, { "category": "external", "summary": "1936877", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1936877" }, { "category": "external", "summary": "1937070", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1937070" }, { "category": "external", "summary": "1937100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1937100" }, { "category": "external", "summary": "1937245", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1937245" }, { "category": "external", "summary": "1937768", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1937768" }, { "category": "external", "summary": "1939026", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939026" }, { "category": "external", "summary": "1939472", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939472" }, { "category": "external", "summary": "1939617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939617" }, { "category": "external", "summary": "1940440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940440" }, { "category": "external", "summary": "1940476", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940476" }, { "category": "external", "summary": "1940957", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940957" }, { "category": "external", "summary": "1941647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1941647" }, { "category": "external", "summary": "1941977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1941977" }, { "category": "external", "summary": "1942344", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942344" }, { "category": "external", "summary": "1942350", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942350" }, { "category": "external", "summary": "1942519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942519" }, { "category": "external", "summary": "1943275", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1943275" }, { "category": "external", "summary": "1943596", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1943596" }, { "category": "external", "summary": "1944980", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1944980" }, { "category": "external", "summary": "1946592", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1946592" }, { "category": "external", "summary": "1946837", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1946837" }, { "category": "external", "summary": "1955328", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955328" }, { "category": "external", "summary": "1955601", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955601" }, { "category": "external", "summary": "1957187", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1957187" }, { "category": "external", "summary": "1957639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1957639" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2041.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Container Storage 4.7.0 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-11T17:47:15+00:00", "generator": { "date": "2024-11-11T17:47:15+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2021:2041", "initial_release_date": "2021-05-19T09:14:24+00:00", "revision_history": [ { "date": "2021-05-19T09:14:24+00:00", "number": "1", "summary": "Initial version" }, { "date": "2021-05-19T09:14:24+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-11T17:47:15+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product": { "name": "Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_container_storage:4.7::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Container Storage" }, { "branches": [ { "category": "product_version", "name": "ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "product": { "name": "ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "product_id": "ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "product_identification_helper": { "purl": "pkg:oci/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234?arch=amd64\u0026repository_url=registry.redhat.io/ocs4/cephcsi-rhel8\u0026tag=4.7-102.5c44836.release_4.7" } } }, { "category": "product_version", "name": "ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "product": { "name": "ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "product_id": "ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "product_identification_helper": { "purl": "pkg:oci/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c?arch=amd64\u0026repository_url=registry.redhat.io/ocs4/mcg-core-rhel8\u0026tag=5.7.0-60.2c1fdb0.5.7" } } }, { "category": "product_version", "name": "ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "product": { "name": "ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "product_id": "ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "product_identification_helper": { "purl": "pkg:oci/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7?arch=amd64\u0026repository_url=registry.redhat.io/ocs4/mcg-rhel8-operator\u0026tag=5.7.0-69.85e2026.5.7" } } }, { "category": "product_version", "name": "ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "product": { "name": "ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "product_id": "ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "product_identification_helper": { "purl": "pkg:oci/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c?arch=amd64\u0026repository_url=registry.redhat.io/ocs4/ocs-must-gather-rhel8\u0026tag=4.7-174.7f14177.release_4.7" } } }, { "category": "product_version", "name": "ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "product": { "name": "ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "product_id": "ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "product_identification_helper": { "purl": "pkg:oci/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc?arch=amd64\u0026repository_url=registry.redhat.io/ocs4/ocs-operator-bundle\u0026tag=4.7.0-11" } } }, { "category": "product_version", "name": "ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "product": { "name": "ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "product_id": "ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "product_identification_helper": { "purl": "pkg:oci/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6?arch=amd64\u0026repository_url=registry.redhat.io/ocs4/ocs-rhel8-operator\u0026tag=4.7-174.7f14177.release_4.7" } } }, { "category": "product_version", "name": "ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "product": { "name": "ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "product_id": "ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "product_identification_helper": { "purl": "pkg:oci/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7?arch=amd64\u0026repository_url=registry.redhat.io/ocs4/rook-ceph-rhel8-operator\u0026tag=4.7-140.49a6fcf.release_4.7" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "product": { "name": "ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "product_id": "ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "product_identification_helper": { "purl": "pkg:oci/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c?arch=s390x\u0026repository_url=registry.redhat.io/ocs4/cephcsi-rhel8\u0026tag=4.7-102.5c44836.release_4.7" } } }, { "category": "product_version", "name": "ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "product": { "name": "ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "product_id": "ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "product_identification_helper": { "purl": "pkg:oci/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e?arch=s390x\u0026repository_url=registry.redhat.io/ocs4/mcg-core-rhel8\u0026tag=5.7.0-60.2c1fdb0.5.7" } } }, { "category": "product_version", "name": "ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "product": { "name": "ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "product_id": "ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "product_identification_helper": { "purl": "pkg:oci/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76?arch=s390x\u0026repository_url=registry.redhat.io/ocs4/mcg-rhel8-operator\u0026tag=5.7.0-69.85e2026.5.7" } } }, { "category": "product_version", "name": "ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "product": { "name": "ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "product_id": "ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "product_identification_helper": { "purl": "pkg:oci/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0?arch=s390x\u0026repository_url=registry.redhat.io/ocs4/ocs-must-gather-rhel8\u0026tag=4.7-174.7f14177.release_4.7" } } }, { "category": "product_version", "name": "ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "product": { "name": "ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "product_id": "ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "product_identification_helper": { "purl": "pkg:oci/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660?arch=s390x\u0026repository_url=registry.redhat.io/ocs4/ocs-operator-bundle\u0026tag=4.7.0-11" } } }, { "category": "product_version", "name": "ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "product": { "name": "ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "product_id": "ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "product_identification_helper": { "purl": "pkg:oci/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5?arch=s390x\u0026repository_url=registry.redhat.io/ocs4/ocs-rhel8-operator\u0026tag=4.7-174.7f14177.release_4.7" } } }, { "category": "product_version", "name": "ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "product": { "name": "ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "product_id": "ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "product_identification_helper": { "purl": "pkg:oci/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2?arch=s390x\u0026repository_url=registry.redhat.io/ocs4/rook-ceph-rhel8-operator\u0026tag=4.7-140.49a6fcf.release_4.7" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "product": { "name": "ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "product_id": "ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "product_identification_helper": { "purl": "pkg:oci/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d?arch=ppc64le\u0026repository_url=registry.redhat.io/ocs4/cephcsi-rhel8\u0026tag=4.7-102.5c44836.release_4.7" } } }, { "category": "product_version", "name": "ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "product": { "name": "ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "product_id": "ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "product_identification_helper": { "purl": "pkg:oci/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c?arch=ppc64le\u0026repository_url=registry.redhat.io/ocs4/mcg-core-rhel8\u0026tag=5.7.0-60.2c1fdb0.5.7" } } }, { "category": "product_version", "name": "ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "product": { "name": "ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "product_id": "ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "product_identification_helper": { "purl": "pkg:oci/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142?arch=ppc64le\u0026repository_url=registry.redhat.io/ocs4/mcg-rhel8-operator\u0026tag=5.7.0-69.85e2026.5.7" } } }, { "category": "product_version", "name": "ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "product": { "name": "ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "product_id": "ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d?arch=ppc64le\u0026repository_url=registry.redhat.io/ocs4/ocs-must-gather-rhel8\u0026tag=4.7-174.7f14177.release_4.7" } } }, { "category": "product_version", "name": "ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "product": { "name": "ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "product_id": "ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047?arch=ppc64le\u0026repository_url=registry.redhat.io/ocs4/ocs-operator-bundle\u0026tag=4.7.0-11" } } }, { "category": "product_version", "name": "ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "product": { "name": "ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "product_id": "ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6?arch=ppc64le\u0026repository_url=registry.redhat.io/ocs4/ocs-rhel8-operator\u0026tag=4.7-174.7f14177.release_4.7" } } }, { "category": "product_version", "name": "ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le", "product": { "name": "ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le", "product_id": "ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le", "product_identification_helper": { "purl": "pkg:oci/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4?arch=ppc64le\u0026repository_url=registry.redhat.io/ocs4/rook-ceph-rhel8-operator\u0026tag=4.7-140.49a6fcf.release_4.7" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le" }, "product_reference": "ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64 as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64" }, "product_reference": "ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x" }, "product_reference": "ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le" }, "product_reference": "ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64 as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64" }, "product_reference": "ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x" }, "product_reference": "ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64 as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64" }, "product_reference": "ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x" }, "product_reference": "ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" }, "product_reference": "ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le" }, "product_reference": "ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x" }, "product_reference": "ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64 as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64" }, "product_reference": "ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64 as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64" }, "product_reference": "ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le" }, "product_reference": "ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x" }, "product_reference": "ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le" }, "product_reference": "ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x" }, "product_reference": "ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64 as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64" }, "product_reference": "ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x" }, "product_reference": "ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64 as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64" }, "product_reference": "ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "relates_to_product_reference": "8Base-RH-OCS-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le as a component of Red Hat OpenShift Container Storage 4.7 on RHEL-8", "product_id": "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" }, "product_reference": "ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le", "relates_to_product_reference": "8Base-RH-OCS-4.7" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7608", "cwe": { "id": "CWE-267", "name": "Privilege Defined With Unsafe Actions" }, "discovery_date": "2020-05-11T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1840004" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-yargs-parser: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x" ], "known_not_affected": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7608" }, { "category": "external", "summary": "RHBZ#1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7608", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7608" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608" } ], "release_date": "2020-03-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-05-19T09:14:24+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:2041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-yargs-parser: prototype pollution vulnerability" }, { "cve": "CVE-2020-7774", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2020-11-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1898680" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n\u0027s locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-y18n: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and OpenShift distributed tracing the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-y18n library to authenticated users only, therefore the impact is Low.\n\nIn Red Hat OpenShift Container Storage 4 the noobaa-core container includes the affected version of y18n as a dependency of yargs. However, no unsafe usage found where the module accepts untrusted input and hence this issue has been rated as having a security impact of Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x" ], "known_not_affected": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7774" }, { "category": "external", "summary": "RHBZ#1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7774", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7774" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887", "url": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887" } ], "release_date": "2020-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-05-19T09:14:24+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:2041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-y18n: prototype pollution vulnerability" }, { "acknowledgments": [ { "names": [ "the Kubernetes Product Security Committee" ] }, { "names": [ "Patrick Rhomberg" ], "organization": "purelyapplied", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-8565", "cwe": { "id": "CWE-117", "name": "Improper Output Neutralization for Logs" }, "discovery_date": "2020-10-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1886638" } ], "notes": [ { "category": "description", "text": "A flaw was found in kubernetes. In Kubernetes, if the logging level is to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like `kubectl`. Previously, CVE-2019-11250 was assigned for the same issue for logging levels of at least 4.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \u003e= 9", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform 4 does not support LogLevels higher than 8 (via \u0027TraceAll\u0027), and is therefore not affected by this vulnerability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ], "known_not_affected": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8565" }, { "category": "external", "summary": "RHBZ#1886638", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1886638" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8565", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8565" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8565", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8565" }, { "category": "external", "summary": "https://github.com/kubernetes/kubernetes/issues/95623", "url": "https://github.com/kubernetes/kubernetes/issues/95623" }, { "category": "external", "summary": "https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk", "url": "https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk" } ], "release_date": "2020-10-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-05-19T09:14:24+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:2041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \u003e= 9" }, { "cve": "CVE-2020-26160", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2020-09-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1883371" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in jwt-go where it is vulnerable to Access Restriction Bypass if m[\"aud\"] happens to be []string{}, as allowed by the spec, the type assertion fails and the value of aud is \"\". This can cause audience verification to succeed even if the audiences being passed are incorrect if required is set to false.", "title": "Vulnerability description" }, { "category": "summary", "text": "jwt-go: access restriction bypass vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "The github.com/dgrijalva/jwt-go module is an indirect dependency of the k8s.io/client-go module pulled into Quay Bridge, and Setup operators via the Operator\u0027s SDK generated code. The k8s.io/client-go module does not use jwt-go in an unsafe way [1]. Red Hat Quay components have been marked as wontfix. This may be fixed in the future.\n\nSimilar to Quay, multiple OpenShift Container Platform (OCP) containers include jwt-go as a transient dependency due to go-autorest [1]. As such, those containers do not use jwt-go in an unsafe way. They have been marked wontfix at this time and may be fixed in a future update.\n\nSame as Quay and OpenShift Container Platform, components shipped with Red Hat OpenShift Container Storage 4 do not use jwt-go in an unsafe way and hence this issue has been rated as having a security impact of Low. A future update may address this issue.\n\nRed Hat Gluster Storage 3 shipped multi-cloud-object-gateway-cli as a technical preview and is not currently planned to be addressed in future updates, hence the multi-cloud-object-gateway-cli package will not be fixed.\n\n[1] https://github.com/Azure/go-autorest/issues/568#issuecomment-703804062", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ], "known_not_affected": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-26160" }, { "category": "external", "summary": "RHBZ#1883371", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883371" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-26160", "url": "https://www.cve.org/CVERecord?id=CVE-2020-26160" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-26160", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26160" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515", "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-05-19T09:14:24+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:2041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jwt-go: access restriction bypass vulnerability" }, { "cve": "CVE-2020-26289", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-12-28T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1911627" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-date-and-time. In date-and-time there a regular expression involved in parsing which can be exploited to cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-date-and-time: ReDoS in parsing via date.compile", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x" ], "known_not_affected": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-26289" }, { "category": "external", "summary": "RHBZ#1911627", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1911627" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-26289", "url": "https://www.cve.org/CVERecord?id=CVE-2020-26289" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-26289", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26289" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-r92x-f52r-x54g", "url": "https://github.com/advisories/GHSA-r92x-f52r-x54g" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1592", "url": "https://www.npmjs.com/advisories/1592" } ], "release_date": "2020-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-05-19T09:14:24+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:2041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-date-and-time: ReDoS in parsing via date.compile" }, { "cve": "CVE-2020-28362", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2020-11-12T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1897635" } ], "notes": [ { "category": "description", "text": "A flaw was found in the math/big package of Go\u0027s standard library that causes a denial of service. Applications written in Go that use math/big via cryptographic packages, including crypto/rsa and crypto/x509, are vulnerable and can potentially cause panic via a crafted certificate chain. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: math/big: panic during recursive division of very large numbers", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift ServiceMesh (OSSM) 1.1 is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities because it is now in the Maintenance Phase of the support.\nOpenshift Virtualization 1 (formerly Container Native Virtualization) is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities.\n\nRed Hat Gluster Storage 3 shipped multi-cloud-object-gateway-cli and noobaa-operator container as a technical preview and is not currently planned to be addressed in future updates.\n\nOpenShift Container Platform (OCP) 4.5 and earlier are built with Go versions earlier than 1.14, which are not affected by this vulnerability. OCP 4.6 is built with Go 1.15 and is affected.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ], "known_not_affected": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-28362" }, { "category": "external", "summary": "RHBZ#1897635", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1897635" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28362", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28362" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28362", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28362" } ], "release_date": "2020-11-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-05-19T09:14:24+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:2041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: math/big: panic during recursive division of very large numbers" }, { "cve": "CVE-2021-3114", "cwe": { "id": "CWE-682", "name": "Incorrect Calculation" }, "discovery_date": "2021-01-21T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1918750" } ], "notes": [ { "category": "description", "text": "A flaw detected in golang: crypto/elliptic, in which P-224 keys as generated can return incorrect inputs, reducing the strength of the cryptography. The highest threat from this vulnerability is confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: crypto/elliptic: incorrect operations on the P-224 curve", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift ServiceMesh (OSSM) 1.1 is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities because it is now in the Maintenance Phase of the support.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ], "known_not_affected": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3114" }, { "category": "external", "summary": "RHBZ#1918750", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1918750" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3114", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3114" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3114", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3114" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/mperVMGa98w", "url": "https://groups.google.com/g/golang-announce/c/mperVMGa98w" } ], "release_date": "2021-01-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-05-19T09:14:24+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:2041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: crypto/elliptic: incorrect operations on the P-224 curve" }, { "acknowledgments": [ { "names": [ "Martin Bukatovic" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2021-3528", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2021-03-10T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1955601" } ], "notes": [ { "category": "description", "text": "A flaw was found in NooBaa, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration.", "title": "Vulnerability description" }, { "category": "summary", "text": "NooBaa: noobaa-operator leaking RPC AuthToken into log files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ], "known_not_affected": [ "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:779479e90095b760fdca7da317aaf09f76b453aa262bd3c1ac0f41f7af483a2d_ppc64le", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:ac0ed0ba8ef78e3b46dcf6936f7d97ac4c0f85ac596f263880b56a12dac36234_amd64", "8Base-RH-OCS-4.7:ocs4/cephcsi-rhel8@sha256:c7b09f1114aa36be379a9f52b3f156499bcd31d7537f1235a364129d1382497c_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:22037eb4c589c5ccf921cd15bb3c82d75fac298d2b53344575c2af7c22d5353c_ppc64le", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:5b1046b56cd5d7cbde64a3cfce800b76b3bd7fb0f535ac2382e97eb8fc93314c_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-core-rhel8@sha256:725dd955d4a2a4c27405d7c0d3141384c1e5bb52276056bc7ab8a35d124dcc0e_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:5e4df11fa489a5aa7a03ff3983c9a35143e3a76667ea652c39b499dbacb9a11d_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:6512915dabeef1d170bd2a61339d6849c175082151bc2f273bef1036738456e0_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-must-gather-rhel8@sha256:ca93487e2344a02ab4da0eb010608082134c7e136f2b3cfa51a2d04b10313b3c_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:70c98f7353bd302c55e6fa2f51cb4385309aafeb4a2901c94b44cee2846679fc_amd64", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:97f334a7c2d147e0cfded896355f7406bd2c893783011e345dbcb474850d0047_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-operator-bundle@sha256:bce44dc4b764b9b3e99d5d2cdc2242667195d6802ee1a5f1f692aa6e633e5660_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:7dca985a1723e1c2169124a70182fd29a633ac7b9e9fa28ae24635e203003bc6_ppc64le", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:e715a9a62462de6c45ca82a3acc5d622d2df12ce965d226eb0a90f1cbfa212c5_s390x", "8Base-RH-OCS-4.7:ocs4/ocs-rhel8-operator@sha256:f6319e4d6e32109deeaebe4d99cc18fd5a272c0655ba73fe2521ca63981efba6_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:1c57a22591b2277403200cf3e254badcc827416fc01efabfd12c03c265a491b2_s390x", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:de99a6b3cefa44dd22c637cfa2fb54c60d2b0e14970466cea19979e2e59668c7_amd64", "8Base-RH-OCS-4.7:ocs4/rook-ceph-rhel8-operator@sha256:e25dc5fd74d37ea3b00898557b71cdefc7d508e748bfb230e18db7c2e3d526f4_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3528" }, { "category": "external", "summary": "RHBZ#1955601", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955601" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3528", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3528" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3528", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3528" } ], "release_date": "2021-03-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-05-19T09:14:24+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:2041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:21e57d86bcf007a70bc5e14ff5f0380a1ea26c4d2d2cdf191e9289d04b1f06e7_amd64", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:94dccc304395df6d8b37f8371737646d07cf289f83b30c78c353e9a4dec05b76_s390x", "8Base-RH-OCS-4.7:ocs4/mcg-rhel8-operator@sha256:bae35f5a3ac521dedd50d8852920f99a3f1c94d1a31a51856eefa24e94516142_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "NooBaa: noobaa-operator leaking RPC AuthToken into log files" } ] }
wid-sec-w-2023-1599
Vulnerability from csaf_certbund
Published
2021-01-13 23:00
Modified
2023-06-29 22:00
Summary
IBM Security Guardium: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
IBM Security Guardium ist eine Lösung für die Überwachung und Auditierung des Datenzugriffs.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Security Guardium ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
Betroffene Betriebssysteme
- Linux
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM Security Guardium ist eine L\u00f6sung f\u00fcr die \u00dcberwachung und Auditierung des Datenzugriffs.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Security Guardium ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1599 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2023-1599.json" }, { "category": "self", "summary": "WID-SEC-2023-1599 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1599" }, { "category": "external", "summary": "IBM Security Bulletin 7008449 vom 2023-06-29", "url": "https://www.ibm.com/support/pages/node/7008449" }, { "category": "external", "summary": "IBM Security Bulletin: 6403463 vom 2021-01-13", "url": "https://www.ibm.com/support/pages/node/6403463" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:0521 vom 2021-02-15", "url": "https://access.redhat.com/errata/RHSA-2021:0521" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:0548 vom 2021-02-16", "url": "https://access.redhat.com/errata/RHSA-2021:0548" }, { "category": "external", "summary": "Ubuntu Security Notice USN-4758-1 vom 2021-03-09", "url": "https://ubuntu.com/security/notices/USN-4758-1" } ], "source_lang": "en-US", "title": "IBM Security Guardium: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-06-29T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:33:43.193+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1599", "initial_release_date": "2021-01-13T23:00:00.000+00:00", "revision_history": [ { "date": "2021-01-13T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2021-02-15T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2021-02-16T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2021-03-08T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2023-06-29T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "5" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "IBM DB2", "product": { "name": "IBM DB2", "product_id": "5104", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:-" } } }, { "category": "product_name", "name": "IBM Security Guardium Insights 2.0.2", "product": { "name": "IBM Security Guardium Insights 2.0.2", "product_id": "316562", "product_identification_helper": { "cpe": "cpe:/a:ibm:security_guardium:10.0" } } } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-14039", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-14039" }, { "cve": "CVE-2020-14145", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-14145" }, { "cve": "CVE-2020-15168", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-15168" }, { "cve": "CVE-2020-15586", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-15586" }, { "cve": "CVE-2020-15778", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-15778" }, { "cve": "CVE-2020-16845", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-16845" }, { "cve": "CVE-2020-24553", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-24553" }, { "cve": "CVE-2020-4166", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-4166" }, { "cve": "CVE-2020-4594", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-4594" }, { "cve": "CVE-2020-4595", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-4595" }, { "cve": "CVE-2020-4596", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-4596" }, { "cve": "CVE-2020-4597", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-4597" }, { "cve": "CVE-2020-4599", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-4599" }, { "cve": "CVE-2020-4600", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-4600" }, { "cve": "CVE-2020-4602", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-4602" }, { "cve": "CVE-2020-4604", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-4604" }, { "cve": "CVE-2020-7608", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-7608" }, { "cve": "CVE-2020-8244", "notes": [ { "category": "description", "text": "In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen." } ], "product_status": { "known_affected": [ "67646", "T000126", "5104", "316562" ] }, "release_date": "2021-01-13T23:00:00Z", "title": "CVE-2020-8244" } ] }
wid-sec-w-2022-2133
Vulnerability from csaf_certbund
Published
2022-11-20 23:00
Modified
2022-12-19 23:00
Summary
JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-Komponenten
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
JFrog Artifactory ist eine universelle DevOps-Lösung.
Angriff
JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar.
Betroffene Betriebssysteme
- UNIX
- Linux
{ "document": { "aggregate_severity": { "text": "niedrig" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "JFrog Artifactory ist eine universelle DevOps-L\u00f6sung.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-2133 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-2133.json" }, { "category": "self", "summary": "WID-SEC-2022-2133 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-2133" }, { "category": "external", "summary": "HCL Article KB0102172 vom 2022-12-19", "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0102172" }, { "category": "external", "summary": "JFrog Fixed Security Vulnerabilities - \u00c4nderungen vom 2022-11-24", "url": "https://www.jfrog.com/confluence/pages/diffpagesbyversion.action?pageId=102634317\u0026selectedPageVersions=159\u0026selectedPageVersions=156" }, { "category": "external", "summary": "JFrog Fixed Security Vulnerabilities vom 2022-11-20", "url": "https://www.jfrog.com/confluence/display/JFROG/Fixed+Security+Vulnerabilities" } ], "source_lang": "en-US", "title": "JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-Komponenten", "tracking": { "current_release_date": "2022-12-19T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:03:58.444+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-2133", "initial_release_date": "2022-11-20T23:00:00.000+00:00", "revision_history": [ { "date": "2022-11-20T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-11-30T23:00:00.000+00:00", "number": "2", "summary": "Neue Informationen von JFrog aufgenommen" }, { "date": "2022-12-19T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von HCL aufgenommen" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "HCL Domino", "product": { "name": "HCL Domino", "product_id": "777623", "product_identification_helper": { "cpe": "cpe:/a:hcltech:domino:-" } } } ], "category": "vendor", "name": "HCL" }, { "branches": [ { "category": "product_name", "name": "JFrog Artifactory \u003c 7.47.7", "product": { "name": "JFrog Artifactory \u003c 7.47.7", "product_id": "T025370", "product_identification_helper": { "cpe": "cpe:/a:jfrog:artifactory:7.47.7" } } } ], "category": "vendor", "name": "JFrog" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-16869", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2019-16869" }, { "cve": "CVE-2019-20444", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2019-20444" }, { "cve": "CVE-2019-20445", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2019-20445" }, { "cve": "CVE-2020-7608", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2020-7608" }, { "cve": "CVE-2020-7789", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2020-7789" }, { "cve": "CVE-2021-26291", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2021-26291" }, { "cve": "CVE-2021-3807", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2021-3807" }, { "cve": "CVE-2021-44906", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2021-44906" }, { "cve": "CVE-2022-0235", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2022-0235" }, { "cve": "CVE-2022-1962", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2022-1962" }, { "cve": "CVE-2022-24823", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2022-24823" }, { "cve": "CVE-2022-25857", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2022-25857" }, { "cve": "CVE-2022-25878", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2022-25878" }, { "cve": "CVE-2022-27191", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2022-27191" }, { "cve": "CVE-2022-28131", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2022-28131" }, { "cve": "CVE-2022-30187", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2022-30187" }, { "cve": "CVE-2022-30633", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2022-30633" }, { "cve": "CVE-2022-30635", "notes": [ { "category": "description", "text": "JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar." } ], "product_status": { "known_affected": [ "777623" ] }, "release_date": "2022-11-20T23:00:00Z", "title": "CVE-2022-30635" } ] }
gsd-2020-7608
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2020-7608", "description": "yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.", "id": "GSD-2020-7608", "references": [ "https://access.redhat.com/errata/RHSA-2021:3917", "https://access.redhat.com/errata/RHSA-2021:2041", "https://access.redhat.com/errata/RHSA-2021:0548", "https://access.redhat.com/errata/RHSA-2021:0521", "https://access.redhat.com/errata/RHSA-2020:5499", "https://access.redhat.com/errata/RHSA-2020:5305", "https://advisories.mageia.org/CVE-2020-7608.html", "https://linux.oracle.com/cve/CVE-2020-7608.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2020-7608" ], "details": "yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.", "id": "GSD-2020-7608", "modified": "2023-12-13T01:21:51.422227Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "report@snyk.io", "ID": "CVE-2020-7608", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "yargs-parser", "version": { "version_data": [ { "version_value": "All versions prior to version 18.1.1 and patches at 13.1.2 and 15.0.1" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Prototype Pollution" } ] } ] }, "references": { "reference_data": [ { "name": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "\u003c13.1.2||\u003e=14.0.0 \u003c15.0.1||\u003e=16.0.0 \u003c18.1.1", "affected_versions": "All versions before 13.1.2, all versions starting from 14.0.0 before 15.0.1, all versions starting from 16.0.0 before 18.1.1", "cvss_v2": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "cwe_ids": [ "CWE-1035", "CWE-20", "CWE-937" ], "date": "2021-07-21", "description": "yargs-parser could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.", "fixed_versions": [ "13.1.2", "15.0.1", "18.1.1" ], "identifier": "CVE-2020-7608", "identifiers": [ "CVE-2020-7608" ], "not_impacted": "All versions starting from 13.1.2 before 14.0.0, all versions starting from 15.0.1 before 16.0.0, all versions starting from 18.1.1", "package_slug": "npm/yargs-parser", "pubdate": "2020-03-16", "solution": "Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or above.", "title": "Improper Input Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-7608" ], "uuid": "a9e73366-2694-40b0-bcc1-795368307084" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:yargs:yargs-parser:*:*:*:*:*:node.js:*:*", "cpe_name": [], "versionEndExcluding": "15.0.1", "versionStartIncluding": "14.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:yargs:yargs-parser:*:*:*:*:*:node.js:*:*", "cpe_name": [], "versionEndExcluding": "18.1.1", "versionStartIncluding": "16.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:yargs:yargs-parser:*:*:*:*:*:node.js:*:*", "cpe_name": [], "versionEndExcluding": "5.0.1", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:yargs:yargs-parser:*:*:*:*:*:node.js:*:*", "cpe_name": [], "versionEndExcluding": "13.1.2", "versionStartIncluding": "6.0.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "report@snyk.io", "ID": "CVE-2020-7608" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-1321" } ] } ] }, "references": { "reference_data": [ { "name": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381", "refsource": "MISC", "tags": [ "Exploit", "Patch", "Third Party Advisory" ], "url": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 3.4 } }, "lastModifiedDate": "2022-11-15T16:40Z", "publishedDate": "2020-03-16T20:15Z" } } }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.