Action not permitted
Modal body text goes here.
cve-2020-8252
Vulnerability from cvelistv5
Published
2020-09-18 20:11
Modified
2024-08-04 09:56
Severity ?
EPSS score ?
Summary
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
References
▼ | URL | Tags | |
---|---|---|---|
support@hackerone.com | http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html | Third Party Advisory | |
support@hackerone.com | http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html | Mailing List, Third Party Advisory | |
support@hackerone.com | https://hackerone.com/reports/965914 | Permissions Required, Third Party Advisory | |
support@hackerone.com | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/ | ||
support@hackerone.com | https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/ | Vendor Advisory | |
support@hackerone.com | https://security.gentoo.org/glsa/202009-15 | Third Party Advisory | |
support@hackerone.com | https://security.netapp.com/advisory/ntap-20201009-0004/ | Third Party Advisory | |
support@hackerone.com | https://usn.ubuntu.com/4548-1/ | Third Party Advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
n/a | https://github.com/nodejs/node |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T09:56:28.202Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://hackerone.com/reports/965914" }, { "name": "GLSA-202009-15", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202009-15" }, { "name": "USN-4548-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/4548-1/" }, { "name": "openSUSE-SU-2020:1616", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20201009-0004/" }, { "name": "openSUSE-SU-2020:1660", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html" }, { "name": "FEDORA-2020-43d5a372fc", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "https://github.com/nodejs/node", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Fixed in 10.22.1, 12.18.4, 14.9.0" } ] } ], "descriptions": [ { "lang": "en", "value": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-120", "description": "Classic Buffer Overflow (CWE-120)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2020-12-13T03:06:13", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/" }, { "tags": [ "x_refsource_MISC" ], "url": "https://hackerone.com/reports/965914" }, { "name": "GLSA-202009-15", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/202009-15" }, { "name": "USN-4548-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/4548-1/" }, { "name": "openSUSE-SU-2020:1616", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20201009-0004/" }, { "name": "openSUSE-SU-2020:1660", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html" }, { "name": "FEDORA-2020-43d5a372fc", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "support@hackerone.com", "ID": "CVE-2020-8252", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "https://github.com/nodejs/node", "version": { "version_data": [ { "version_value": "Fixed in 10.22.1, 12.18.4, 14.9.0" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Classic Buffer Overflow (CWE-120)" } ] } ] }, "references": { "reference_data": [ { "name": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/", "refsource": "MISC", "url": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/" }, { "name": "https://hackerone.com/reports/965914", "refsource": "MISC", "url": "https://hackerone.com/reports/965914" }, { "name": "GLSA-202009-15", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202009-15" }, { "name": "USN-4548-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4548-1/" }, { "name": "openSUSE-SU-2020:1616", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html" }, { "name": "https://security.netapp.com/advisory/ntap-20201009-0004/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20201009-0004/" }, { "name": "openSUSE-SU-2020:1660", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html" }, { "name": "FEDORA-2020-43d5a372fc", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/" } ] } } } }, "cveMetadata": { "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2020-8252", "datePublished": "2020-09-18T20:11:51", "dateReserved": "2020-01-28T00:00:00", "dateUpdated": "2024-08-04T09:56:28.202Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2020-8252\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2020-09-18T21:15:13.497\",\"lastModified\":\"2023-11-07T03:26:19.070\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.\"},{\"lang\":\"es\",\"value\":\"La implementaci\u00f3n de realpath en libuv versiones anteriores a versiones anteriores a 10.22.1, versiones anteriores a 12.18.4 y versiones anteriores a 14.9.0, usada dentro de Node.js determin\u00f3 incorrectamente el tama\u00f1o del b\u00fafer, lo que puede resultar en un desbordamiento del b\u00fafer si la ruta resuelta tiene m\u00e1s de 256 bytes\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":4.6},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]},{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.22.1\",\"matchCriteriaId\":\"3161B3E1-1269-4718-AE6A-2C122E1B52D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"12.0.0\",\"versionEndExcluding\":\"12.18.4\",\"matchCriteriaId\":\"3CB8E8E0-24CC-417B-96D7-AF53B2296661\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"14.0.0\",\"versionEndExcluding\":\"14.9.0\",\"matchCriteriaId\":\"F0300B3A-89AE-40AF-BDAF-EB3F5DA6A66E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B009C22E-30A4-4288-BCF6-C3E81DEAF45A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html\",\"source\":\"support@hackerone.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://hackerone.com/reports/965914\",\"source\":\"support@hackerone.com\",\"tags\":[\"Permissions Required\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/\",\"source\":\"support@hackerone.com\"},{\"url\":\"https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202009-15\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20201009-0004/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4548-1/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
ghsa-c5r6-cm8r-wgh9
Vulnerability from github
Published
2022-05-24 17:29
Modified
2022-05-25 00:00
Severity ?
Details
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
{ "affected": [], "aliases": [ "CVE-2020-8252" ], "database_specific": { "cwe_ids": [ "CWE-120" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2020-09-18T21:15:00Z", "severity": "CRITICAL" }, "details": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.", "id": "GHSA-c5r6-cm8r-wgh9", "modified": "2022-05-25T00:00:31Z", "published": "2022-05-24T17:29:12Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252" }, { "type": "WEB", "url": "https://hackerone.com/reports/965914" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6" }, { "type": "WEB", "url": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/202009-15" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20201009-0004" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4548-1" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
wid-sec-w-2023-0486
Vulnerability from csaf_certbund
Published
2020-09-15 22:00
Modified
2023-02-27 23:00
Summary
Node.js: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.
Betroffene Betriebssysteme
- UNIX
- Linux
- Windows
- Sonstiges
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0486 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2023-0486.json" }, { "category": "self", "summary": "WID-SEC-2023-0486 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0486" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-110 vom 2023-02-28", "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-110/index.html" }, { "category": "external", "summary": "Node.js Security Releases vom 2020-09-15", "url": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases" }, { "category": "external", "summary": "Ubuntu Security Notice USN-4548-1 vom 2020-09-28", "url": "https://usn.ubuntu.com/4548-1/" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202009-15 vom 2020-09-29", "url": "https://security.gentoo.org/glsa/202009-15" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2020:2813-1 vom 2020-10-01", "url": "http://lists.suse.com/pipermail/sle-security-updates/2020-October/007508.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2020:2812-1 vom 2020-10-01", "url": "http://lists.suse.com/pipermail/sle-security-updates/2020-October/007509.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2020:2823-1 vom 2020-10-01", "url": "http://lists.suse.com/pipermail/sle-security-updates/2020-October/007512.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2020:2829-1 vom 2020-10-02", "url": "http://lists.suse.com/pipermail/sle-security-updates/2020-October/007514.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:4272 vom 2020-10-19", "url": "https://access.redhat.com/errata/RHSA-2020:4272" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:4903 vom 2020-11-04", "url": "https://access.redhat.com/errata/RHSA-2020:4903" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:5086 vom 2020-11-11", "url": "https://access.redhat.com/errata/RHSA-2020:5086" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202101-07 vom 2021-01-11", "url": "https://security.gentoo.org/glsa/202101-07" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:0521 vom 2021-02-15", "url": "https://access.redhat.com/errata/RHSA-2021:0521" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:0548 vom 2021-02-16", "url": "https://access.redhat.com/errata/RHSA-2021:0548" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2021-0548 vom 2021-02-20", "url": "https://linux.oracle.com/errata/ELSA-2021-0548.html" }, { "category": "external", "summary": "HCL Article KB0090800 vom 2021-08-03", "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0090800" } ], "source_lang": "en-US", "title": "Node.js: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-02-27T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:16:15.097+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-0486", "initial_release_date": "2020-09-15T22:00:00.000+00:00", "revision_history": [ { "date": "2020-09-15T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2020-09-28T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2020-09-29T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2020-10-01T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2020-10-04T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2020-10-18T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-11-04T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-11-11T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2021-01-10T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2021-02-15T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2021-02-16T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2021-02-21T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2021-08-02T22:00:00.000+00:00", "number": "13", "summary": "Neue Updates von HCL aufgenommen" }, { "date": "2023-02-27T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von HITACHI aufgenommen" } ], "status": "final", "version": "14" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "HCL BigFix", "product": { "name": "HCL BigFix", "product_id": "T017494", "product_identification_helper": { "cpe": "cpe:/a:hcltech:bigfix:-" } } } ], "category": "vendor", "name": "HCL" }, { "branches": [ { "category": "product_name", "name": "Hitachi Ops Center Analyzer \u003c 10.9.1-00", "product": { "name": "Hitachi Ops Center Analyzer \u003c 10.9.1-00", "product_id": "T026522", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:analyzer__10.9.1-00" } } } ], "category": "vendor", "name": "Hitachi" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Open Source Node.js \u003c 14.11.0", "product": { "name": "Open Source Node.js \u003c 14.11.0", "product_id": "T017281", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:14.11.0" } } }, { "category": "product_name", "name": "Open Source Node.js \u003c 12.18.4 LTS", "product": { "name": "Open Source Node.js \u003c 12.18.4 LTS", "product_id": "T017282", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:12.18.4_lts" } } }, { "category": "product_name", "name": "Open Source Node.js \u003c 10.22.1 LTS", "product": { "name": "Open Source Node.js \u003c 10.22.1 LTS", "product_id": "T017283", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:10.22.1_lts" } } } ], "category": "product_name", "name": "Node.js" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-8201", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in Node.js. Carriage Returns werden in HTTP-Request-Headern vor dem Parsen in einen Bindestrich konvertiert. Dies kann zum Schmuggeln von HTTP-Anfragen f\u00fchren, da es sich um eine nicht standardm\u00e4\u00dfige Interpretation des Headers handelt. Ein Angreifer kann das ausnutzen, um Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T026522", "T012167", "T004914", "T017494" ] }, "release_date": "2020-09-15T22:00:00Z", "title": "CVE-2020-8201" }, { "cve": "CVE-2020-8251", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in Node.js. Aufgrund einer verz\u00f6gerten \u00dcbermittlung von Anfragen ist ein Server unter Umst\u00e4nden nicht in der Lage neue Verbindungen anzunehmen. Ein entfernter anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T026522", "T012167", "T004914" ] }, "release_date": "2020-09-15T22:00:00Z", "title": "CVE-2020-8251" }, { "cve": "CVE-2020-8252", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in Node.js. Aufgrund einer falschen Bestimmung der Puffergr\u00f6\u00dfe in der Realpath-Implementierung von libuv kommt es zu einem Puffer \u00dcberlauf, wenn der aufgel\u00f6ste Pfad l\u00e4nger als 256 Bytes ist. Ein Angreifer kann diese Schwachstelle mit nicht spezifizierten Auswirkungen ausnutzen." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T026522", "T012167", "T004914" ] }, "release_date": "2020-09-15T22:00:00Z", "title": "CVE-2020-8252" } ] }
icsa-22-111-03
Vulnerability from csaf_cisa
Published
2022-04-21 00:00
Modified
2022-04-21 00:00
Summary
Hitachi Energy MicroSCADA Pro/X SYS600
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities could allow an attacker to eavesdrop on traffic between network source and destination, gain unauthorized access to information, or cause a denial-of-service condition.
Critical infrastructure sectors
Energy
Countries/areas deployed
Worldwide
Company headquarters location
Switzerland
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Exploitability
No known public exploits specifically target these vulnerabilities.
{ "document": { "acknowledgments": [ { "organization": "Hitachi Energy", "summary": "reporting these vulnerabilities to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of these vulnerabilities could allow an attacker to eavesdrop on traffic between network source and destination, gain unauthorized access to information, or cause a denial-of-service condition.", "title": "Risk evaluation" }, { "category": "other", "text": "Energy", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Switzerland", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "other", "text": "No known public exploits specifically target these vulnerabilities.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "ICS Advisory ICSA-22-111-03 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-111-03.json" }, { "category": "self", "summary": "ICS Advisory ICSA-22-111-03 Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-111-03" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Hitachi Energy MicroSCADA Pro/X SYS600", "tracking": { "current_release_date": "2022-04-21T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-22-111-03", "initial_release_date": "2022-04-21T00:00:00.000000Z", "revision_history": [ { "date": "2022-04-21T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "ICSA-22-111-03 Hitachi Energy MicroSCADA ProX SYS600" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c= 10.1.1", "product": { "name": " SYS600: Versions 10.1.1 and prior", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": " SYS600" }, { "branches": [ { "category": "product_version_range", "name": "\u003c=9.4 FP1 | \u003e= 10.2.1", "product": { "name": " SYS600: Versions 10.1.1 and prior", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": " SYS600" }, { "branches": [ { "category": "product_version_range", "name": "\u003e= 10.0.0 | \u003c= 10.2.1", "product": { "name": " SYS600: Versions 10.1.1 and prior", "product_id": "CSAFPID-0003" } } ], "category": "product_name", "name": " SYS600" } ], "category": "vendor", "name": "Hitachi Energy" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-1968", "cwe": { "id": "CWE-203", "name": "Observable Discrepancy" }, "notes": [ { "category": "summary", "text": "The Raccoon attack exploits a flaw in the TLS specification that can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. This would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note this vulnerability only impacts DH ciphersuites and not ECDH ciphersuites. This vulnerability affects OpenSSL 1.0.2, which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).CVE-2020-1968 has been assigned to this vulnerability. A CVSS v3 base score of 3.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1968" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "For more information see Hitachi Energy advisory 8DBD000075", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-8265", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "notes": [ { "category": "summary", "text": "Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP request smuggling.CVE-2020-8265 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8265" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "For more information see Hitachi Energy advisory 8DBD000075", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-8287", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "notes": [ { "category": "summary", "text": "Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP request smuggling.CVE-2020-8287 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8287" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "For more information see Hitachi Energy advisory 8DBD000075", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-8201", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "notes": [ { "category": "summary", "text": "Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack is possible due to a bug in processing of carrier-return symbols in the HTTP header names.CVE-2020-8201 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8201" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "For more information see Hitachi Energy advisory 8DBD000075", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-8252", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "notes": [ { "category": "summary", "text": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size, which can result in a buffer overflow if the resolved path is longer than 256 bytes.CVE-2020-8252 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8252" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "For more information see Hitachi Energy advisory 8DBD000075", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-8172", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "summary", "text": "TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.CVE-2020-8172 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8172" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "For more information see Hitachi Energy advisory 8DBD000075", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-8174", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "napi_get_value_string_*() allows various kinds of memory corruption in node \u003c 10.21.0, 12.18.0, and \u003c 14.4.0.CVE-2020-8174 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8174" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "For more information see Hitachi Energy advisory 8DBD000075", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-32027", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "A vulnerability was found in postgresql in versions prior to 13.3, 12.7, 11.12, 10.17, and 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.CVE-2021-32027 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32027" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "For more information see Hitachi Energy advisory 8DBD000075", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-32028", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.CVE-2021-32028 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32028" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "For more information see Hitachi Energy advisory 8DBD000075", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] } ] }
rhsa-2020_4903
Vulnerability from csaf_redhat
Published
2020-11-04 12:35
Modified
2024-11-15 09:37
Summary
Red Hat Security Advisory: nodejs:12 security and bug fix update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (12.18.4).
Security Fix(es):
* nodejs-dot-prop: prototype pollution (CVE-2020-8116)
* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)
* npm: Sensitive information exposure through logs (CVE-2020-15095)
* libuv: buffer overflow in realpath (CVE-2020-8252)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* The nodejs:12/development module is not installable (BZ#1883965)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.4).\n\nSecurity Fix(es):\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)\n\n* npm: Sensitive information exposure through logs (CVE-2020-15095)\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* The nodejs:12/development module is not installable (BZ#1883965)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4903", "url": "https://access.redhat.com/errata/RHSA-2020:4903" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "1879311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311" }, { "category": "external", "summary": "1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "1883965", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883965" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4903.json" } ], "title": "Red Hat Security Advisory: nodejs:12 security and bug fix update", "tracking": { "current_release_date": "2024-11-15T09:37:55+00:00", "generator": { "date": "2024-11-15T09:37:55+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4903", "initial_release_date": "2020-11-04T12:35:47+00:00", "revision_history": [ { "date": "2020-11-04T12:35:47+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-11-04T12:35:47+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T09:37:55+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.1::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8010020201006223055:c27ad7f8", "product": { "name": "nodejs:12:8010020201006223055:c27ad7f8", "product_id": "nodejs:12:8010020201006223055:c27ad7f8", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8010020201006223055:c27ad7f8" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "product": { "name": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "product_id": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "product": { "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product": { "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product": { "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64", "product": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64", "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product": { "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product": { "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "product": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product": { "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product": { "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "product": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product": { "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product": { "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "product": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, "product_reference": "nodejs:12:8010020201006223055:c27ad7f8", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64" }, "product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le" }, "product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x" }, "product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src" }, "product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64" }, "product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64" }, "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x" }, "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64" }, "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x" }, "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64" }, "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64" }, "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le" }, "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x" }, "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64" }, "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch" }, "product_reference": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64" }, "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x" }, "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64" }, "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le" }, "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x" }, "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" }, "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-8116", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-08-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1868196" } ], "notes": [ { "category": "description", "text": "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-dot-prop: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8116" }, { "category": "external", "summary": "RHBZ#1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8116", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8116" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116" }, { "category": "external", "summary": "https://hackerone.com/reports/719856", "url": "https://hackerone.com/reports/719856" } ], "release_date": "2020-01-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T12:35:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4903" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-dot-prop: prototype pollution" }, { "cve": "CVE-2020-8201", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2020-09-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1879311" } ], "notes": [ { "category": "description", "text": "A flaw was found in Node.js, where affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This flaw leads to HTTP Request Smuggling as it is a non-standard interpretation of the header. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion", "title": "Vulnerability summary" }, { "category": "other", "text": "Node.js is included in Red Hat Quay as a dependency of Yarn, which is only used while building Red Hat Quay, and not during runtime.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8201" }, { "category": "external", "summary": "RHBZ#1879311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8201", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T12:35:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4903" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion" }, { "cve": "CVE-2020-8252", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-09-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1879315" } ], "notes": [ { "category": "description", "text": "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "libuv: buffer overflow in realpath", "title": "Vulnerability summary" }, { "category": "other", "text": "As shipped in Red Hat Software Collections (nodejs-10 \u0026 nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8252" }, { "category": "external", "summary": "RHBZ#1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8252", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8252" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T12:35:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4903" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "libuv: buffer overflow in realpath" }, { "cve": "CVE-2020-15095", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2020-07-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1856875" } ], "notes": [ { "category": "description", "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.", "title": "Vulnerability description" }, { "category": "summary", "text": "npm: sensitive information exposure through logs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15095" }, { "category": "external", "summary": "RHBZ#1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15095", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15095" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095" } ], "release_date": "2020-07-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T12:35:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4903" }, { "category": "workaround", "details": "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.", "product_ids": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x", "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm: sensitive information exposure through logs" } ] }
rhsa-2020_5086
Vulnerability from csaf_redhat
Published
2020-11-12 09:44
Modified
2024-11-15 09:38
Summary
Red Hat Security Advisory: rh-nodejs12-nodejs security update
Notes
Topic
An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.18.4). (BZ#1878550, BZ#1888291, BZ#1888298)
Security Fix(es):
* nodejs-dot-prop: prototype pollution (CVE-2020-8116)
* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)
* npm: Sensitive information exposure through logs (CVE-2020-15095)
* libuv: buffer overflow in realpath (CVE-2020-8252)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.18.4). (BZ#1878550, BZ#1888291, BZ#1888298)\n\nSecurity Fix(es):\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)\n\n* npm: Sensitive information exposure through logs (CVE-2020-15095)\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:5086", "url": "https://access.redhat.com/errata/RHSA-2020:5086" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "1879311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311" }, { "category": "external", "summary": "1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5086.json" } ], "title": "Red Hat Security Advisory: rh-nodejs12-nodejs security update", "tracking": { "current_release_date": "2024-11-15T09:38:03+00:00", "generator": { "date": "2024-11-15T09:38:03+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:5086", "initial_release_date": "2020-11-12T09:44:59+00:00", "revision_history": [ { "date": "2020-11-12T09:44:59+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-11-12T09:44:59+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T09:38:03+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.18.4-3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.18.4-3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "product": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "product_id": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.6-12.18.4.3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.18.4-3.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "product_id": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.18.4-3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "product_id": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.18.4-3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "product": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "product_id": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.6-12.18.4.3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.18.4-3.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "product": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "product_id": "rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.18.4-3.el7?arch=aarch64" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "product_id": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.18.4-3.el7?arch=aarch64" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "product": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "product_id": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.6-12.18.4.3.el7?arch=aarch64" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.18.4-3.el7?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "product": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "product_id": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.18.4-3.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "product": { "name": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "product_id": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-docs@12.18.4-3.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "product_id": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.18.4-3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "product_id": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.18.4-3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "product": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "product_id": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.6-12.18.4.3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.18.4-3.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "relates_to_product_reference": "7Server-Alt-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.5" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.5" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-8116", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-08-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1868196" } ], "notes": [ { "category": "description", "text": "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-dot-prop: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8116" }, { "category": "external", "summary": "RHBZ#1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8116", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8116" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116" }, { "category": "external", "summary": "https://hackerone.com/reports/719856", "url": "https://hackerone.com/reports/719856" } ], "release_date": "2020-01-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-12T09:44:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5086" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-dot-prop: prototype pollution" }, { "cve": "CVE-2020-8201", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2020-09-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1879311" } ], "notes": [ { "category": "description", "text": "A flaw was found in Node.js, where affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This flaw leads to HTTP Request Smuggling as it is a non-standard interpretation of the header. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion", "title": "Vulnerability summary" }, { "category": "other", "text": "Node.js is included in Red Hat Quay as a dependency of Yarn, which is only used while building Red Hat Quay, and not during runtime.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8201" }, { "category": "external", "summary": "RHBZ#1879311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8201", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-12T09:44:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5086" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion" }, { "cve": "CVE-2020-8252", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-09-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1879315" } ], "notes": [ { "category": "description", "text": "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "libuv: buffer overflow in realpath", "title": "Vulnerability summary" }, { "category": "other", "text": "As shipped in Red Hat Software Collections (nodejs-10 \u0026 nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8252" }, { "category": "external", "summary": "RHBZ#1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8252", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8252" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-12T09:44:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5086" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libuv: buffer overflow in realpath" }, { "cve": "CVE-2020-15095", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2020-07-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1856875" } ], "notes": [ { "category": "description", "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.", "title": "Vulnerability description" }, { "category": "summary", "text": "npm: sensitive information exposure through logs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15095" }, { "category": "external", "summary": "RHBZ#1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15095", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15095" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095" } ], "release_date": "2020-07-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-12T09:44:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5086" }, { "category": "workaround", "details": "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.", "product_ids": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-Alt-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.6.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5-7.7.Z:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Server-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Server-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.src", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-devel-0:12.18.4-3.el7.x86_64", "7Workstation-RHSCL-3.5:rh-nodejs12-nodejs-docs-0:12.18.4-3.el7.noarch", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.aarch64", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.ppc64le", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.s390x", "7Workstation-RHSCL-3.5:rh-nodejs12-npm-0:6.14.6-12.18.4.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm: sensitive information exposure through logs" } ] }
rhsa-2021_0548
Vulnerability from csaf_redhat
Published
2021-02-16 14:25
Modified
2024-11-15 09:39
Summary
Red Hat Security Advisory: nodejs:10 security update
Notes
Topic
An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (10.23.1).
Security Fix(es):
* libuv: buffer overflow in realpath (CVE-2020-8252)
* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs-dot-prop: prototype pollution (CVE-2020-8116)
* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
* npm: sensitive information exposure through logs (CVE-2020-15095)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2021:0548", "url": "https://access.redhat.com/errata/RHSA-2021:0548" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "1892430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892430" }, { "category": "external", "summary": "1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "1912854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912854" }, { "category": "external", "summary": "1912863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912863" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0548.json" } ], "title": "Red Hat Security Advisory: nodejs:10 security update", "tracking": { "current_release_date": "2024-11-15T09:39:41+00:00", "generator": { "date": "2024-11-15T09:39:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2021:0548", "initial_release_date": "2021-02-16T14:25:46+00:00", "revision_history": [ { "date": "2021-02-16T14:25:46+00:00", "number": "1", "summary": "Initial version" }, { "date": "2021-02-16T14:25:46+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T09:39:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:10:8030020210118191659:229f0a1c", "product": { "name": "nodejs:10:8030020210118191659:229f0a1c", "product_id": "nodejs:10:8030020210118191659:229f0a1c", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@10:8030020210118191659:229f0a1c" } } }, { "category": "product_version", "name": "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "product": { "name": "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "product_id": "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8%2B2632%2B6c5111ed?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8%2B2873%2Baa7dfd9a?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "product": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "product_id": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "product": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "product_id": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8%2B2632%2B6c5111ed?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "product_id": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8%2B2873%2Baa7dfd9a?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "product": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "product_id": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "product": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "product_id": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", "product": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", "product_id": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, "product_reference": "nodejs:10:8030020210118191659:229f0a1c", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src" }, "product_reference": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch" }, "product_reference": "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64" }, "product_reference": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le" }, "product_reference": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x" }, "product_reference": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" }, "product_reference": "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7608", "cwe": { "id": "CWE-267", "name": "Privilege Defined With Unsafe Actions" }, "discovery_date": "2020-05-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1840004" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-yargs-parser: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7608" }, { "category": "external", "summary": "RHBZ#1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7608", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7608" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608" } ], "release_date": "2020-03-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-yargs-parser: prototype pollution vulnerability" }, { "cve": "CVE-2020-7754", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1892430" } ], "notes": [ { "category": "description", "text": "This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat Enterprise Linux 8 and Software Collections, `npm-user-validate` is used exclusively for `npm`. As a result, this vulnerability is considered Low in such a context.\n\nIn OpenShift Container Platform (OCP) 3.11 and 4.4 the kibana package has been marked Low (similar to RHEL8) as it is primarily used for npm and is protected via OpenShift OAuth. Additionally, whilst OCP 4.4 does deliver the kibana package, due to the code changing to container first content, it has been marked as wontfix at this time and may be fixed in a future release. \n\nAdditionally, the openshift4/ose-logging-kibana6 container is not represented on the CVE page as it gets npm from the Red Hat Software Collections and as such the ose-logging-kibana6 container will be updated when the rh-nodejs10-nodejs package is.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7754" }, { "category": "external", "summary": "RHBZ#1892430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892430" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7754", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7754" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7754", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7754" }, { "category": "external", "summary": "https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p", "url": "https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p" } ], "release_date": "2020-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS" }, { "cve": "CVE-2020-7774", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2020-11-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1898680" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n\u0027s locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-y18n: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and OpenShift distributed tracing the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-y18n library to authenticated users only, therefore the impact is Low.\n\nIn Red Hat OpenShift Container Storage 4 the noobaa-core container includes the affected version of y18n as a dependency of yargs. However, no unsafe usage found where the module accepts untrusted input and hence this issue has been rated as having a security impact of Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7774" }, { "category": "external", "summary": "RHBZ#1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7774", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7774" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887", "url": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887" } ], "release_date": "2020-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-y18n: prototype pollution vulnerability" }, { "cve": "CVE-2020-7788", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-12-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1907444" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ini: Prototype pollution via malicious INI file", "title": "Vulnerability summary" }, { "category": "other", "text": "Node.JS packages in Red Hat Enterprise Linux and Red Hat Software Collections included the vulnerable dependency packaged in \"nodejs-npm\" component. Processing malicious files using npm could potentially trigger this vulnerability. The \"ini\" package bundled with npm was not in the library path where it could be included directly in other programs.\n\nThe nodejs-nodemon packages in Red Hat Enterprise Linux and Red Hat Software Collections are affected by this vulnerability as they bundle the nodejs-ini library. Usage of that library is governed by nodemon itself, so applications started by nodemon are not impacted. Further, nodemon is a developer tool not intended to be used in production.\n\nThe ini package is included in Red Hat Quay by protractor and webpack-cli, both of which are dev dependencies.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7788" }, { "category": "external", "summary": "RHBZ#1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7788", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7788" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788" } ], "release_date": "2020-12-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ini: Prototype pollution via malicious INI file" }, { "cve": "CVE-2020-8116", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-08-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1868196" } ], "notes": [ { "category": "description", "text": "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-dot-prop: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8116" }, { "category": "external", "summary": "RHBZ#1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8116", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8116" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116" }, { "category": "external", "summary": "https://hackerone.com/reports/719856", "url": "https://hackerone.com/reports/719856" } ], "release_date": "2020-01-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-dot-prop: prototype pollution" }, { "cve": "CVE-2020-8252", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-09-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1879315" } ], "notes": [ { "category": "description", "text": "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "libuv: buffer overflow in realpath", "title": "Vulnerability summary" }, { "category": "other", "text": "As shipped in Red Hat Software Collections (nodejs-10 \u0026 nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8252" }, { "category": "external", "summary": "RHBZ#1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8252", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8252" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libuv: buffer overflow in realpath" }, { "cve": "CVE-2020-8265", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2021-01-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1912854" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: use-after-free in the TLS implementation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8265" }, { "category": "external", "summary": "RHBZ#1912854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912854" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8265", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8265" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8265", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8265" }, { "category": "external", "summary": "https://hackerone.com/reports/988103", "url": "https://hackerone.com/reports/988103" } ], "release_date": "2021-01-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: use-after-free in the TLS implementation" }, { "cve": "CVE-2020-8287", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-01-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1912863" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP request smuggling via two copies of a header field in an http request", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8287" }, { "category": "external", "summary": "RHBZ#1912863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912863" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8287", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8287" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8287", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8287" } ], "release_date": "2021-01-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: HTTP request smuggling via two copies of a header field in an http request" }, { "cve": "CVE-2020-15095", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2020-07-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1856875" } ], "notes": [ { "category": "description", "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.", "title": "Vulnerability description" }, { "category": "summary", "text": "npm: sensitive information exposure through logs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15095" }, { "category": "external", "summary": "RHBZ#1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15095", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15095" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095" } ], "release_date": "2020-07-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" }, { "category": "workaround", "details": "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm: sensitive information exposure through logs" }, { "cve": "CVE-2020-15366", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1857977" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-ajv library to authenticated users only, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15366" }, { "category": "external", "summary": "RHBZ#1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15366", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15366" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-AJV-584908", "url": "https://snyk.io/vuln/SNYK-JS-AJV-584908" } ], "release_date": "2020-07-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-16T14:25:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0548" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function" } ] }
rhsa-2020_4272
Vulnerability from csaf_redhat
Published
2020-10-19 14:37
Modified
2024-11-15 09:37
Summary
Red Hat Security Advisory: nodejs:12 security and bug fix update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (12.18.4).
Security Fix(es):
* nodejs-dot-prop: prototype pollution (CVE-2020-8116)
* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)
* npm: Sensitive information exposure through logs (CVE-2020-15095)
* libuv: buffer overflow in realpath (CVE-2020-8252)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* The nodejs:12/development module is not installable (BZ#1883966)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.4).\n\nSecurity Fix(es):\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)\n\n* npm: Sensitive information exposure through logs (CVE-2020-15095)\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* The nodejs:12/development module is not installable (BZ#1883966)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4272", "url": "https://access.redhat.com/errata/RHSA-2020:4272" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "1879311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311" }, { "category": "external", "summary": "1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "1883966", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883966" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4272.json" } ], "title": "Red Hat Security Advisory: nodejs:12 security and bug fix update", "tracking": { "current_release_date": "2024-11-15T09:37:45+00:00", "generator": { "date": "2024-11-15T09:37:45+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4272", "initial_release_date": "2020-10-19T14:37:38+00:00", "revision_history": [ { "date": "2020-10-19T14:37:38+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-10-19T14:37:38+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T09:37:45+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8020020201007080935:4cda2c84", "product": { "name": "nodejs:12:8020020201007080935:4cda2c84", "product_id": "nodejs:12:8020020201007080935:4cda2c84", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8020020201007080935:4cda2c84" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "product": { "name": "nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "product_id": "nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "product": { "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "product_id": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product": { "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product_id": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product": { "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product_id": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64", "product": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64", "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product": { "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product_id": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product": { "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product_id": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "product": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product": { "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product_id": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product": { "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product_id": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "product": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product": { "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product_id": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product": { "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product_id": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "product": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, "product_reference": "nodejs:12:8020020201007080935:4cda2c84", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64" }, "product_reference": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le" }, "product_reference": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x" }, "product_reference": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src" }, "product_reference": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64" }, "product_reference": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64" }, "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x" }, "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64" }, "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x" }, "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64" }, "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64" }, "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le" }, "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x" }, "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64" }, "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch" }, "product_reference": "nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64" }, "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x" }, "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64" }, "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le" }, "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x" }, "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64 as a component of nodejs:12:8020020201007080935:4cda2c84 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" }, "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-8116", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-08-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1868196" } ], "notes": [ { "category": "description", "text": "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-dot-prop: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8116" }, { "category": "external", "summary": "RHBZ#1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8116", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8116" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116" }, { "category": "external", "summary": "https://hackerone.com/reports/719856", "url": "https://hackerone.com/reports/719856" } ], "release_date": "2020-01-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-19T14:37:38+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4272" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-dot-prop: prototype pollution" }, { "cve": "CVE-2020-8201", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2020-09-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1879311" } ], "notes": [ { "category": "description", "text": "A flaw was found in Node.js, where affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This flaw leads to HTTP Request Smuggling as it is a non-standard interpretation of the header. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion", "title": "Vulnerability summary" }, { "category": "other", "text": "Node.js is included in Red Hat Quay as a dependency of Yarn, which is only used while building Red Hat Quay, and not during runtime.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8201" }, { "category": "external", "summary": "RHBZ#1879311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8201", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-19T14:37:38+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4272" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion" }, { "cve": "CVE-2020-8252", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-09-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1879315" } ], "notes": [ { "category": "description", "text": "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "libuv: buffer overflow in realpath", "title": "Vulnerability summary" }, { "category": "other", "text": "As shipped in Red Hat Software Collections (nodejs-10 \u0026 nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8252" }, { "category": "external", "summary": "RHBZ#1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8252", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8252" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-19T14:37:38+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4272" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libuv: buffer overflow in realpath" }, { "cve": "CVE-2020-15095", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2020-07-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1856875" } ], "notes": [ { "category": "description", "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.", "title": "Vulnerability description" }, { "category": "summary", "text": "npm: sensitive information exposure through logs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15095" }, { "category": "external", "summary": "RHBZ#1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15095", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15095" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095" } ], "release_date": "2020-07-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-19T14:37:38+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4272" }, { "category": "workaround", "details": "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.", "product_ids": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x", "AppStream-8.2.0.Z.MAIN.EUS:nodejs:12:8020020201007080935:4cda2c84:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm: sensitive information exposure through logs" } ] }
rhsa-2021_0521
Vulnerability from csaf_redhat
Published
2021-02-15 18:28
Modified
2024-11-15 09:39
Summary
Red Hat Security Advisory: rh-nodejs10-nodejs security update
Notes
Topic
An update for rh-nodejs10-nodejs is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.23.1).
Security Fix(es):
* libuv: buffer overflow in realpath (CVE-2020-8252)
* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs-dot-prop: prototype pollution (CVE-2020-8116)
* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
* npm: sensitive information exposure through logs (CVE-2020-15095)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs10-nodejs is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2021:0521", "url": "https://access.redhat.com/errata/RHSA-2021:0521" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "1892430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892430" }, { "category": "external", "summary": "1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "1912854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912854" }, { "category": "external", "summary": "1912863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912863" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0521.json" } ], "title": "Red Hat Security Advisory: rh-nodejs10-nodejs security update", "tracking": { "current_release_date": "2024-11-15T09:39:32+00:00", "generator": { "date": "2024-11-15T09:39:32+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2021:0521", "initial_release_date": "2021-02-15T18:28:29+00:00", "revision_history": [ { "date": "2021-02-15T18:28:29+00:00", "number": "1", "summary": "Initial version" }, { "date": "2021-02-15T18:28:29+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T09:39:32+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product": { "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "product": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "product_id": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs@10.23.1-2.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "product": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "product_id": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs@10.23.1-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "product": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "product_id": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-devel@10.23.1-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "product": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "product_id": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-npm@6.14.10-10.23.1.2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "product": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "product_id": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-debuginfo@10.23.1-2.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "product": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "product_id": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs@10.23.1-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "product": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "product_id": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-devel@10.23.1-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "product": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "product_id": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-npm@6.14.10-10.23.1.2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "product": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "product_id": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-debuginfo@10.23.1-2.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "product": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "product_id": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs@10.23.1-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "product": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "product_id": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-devel@10.23.1-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "product": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "product_id": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-npm@6.14.10-10.23.1.2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "product": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "product_id": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-debuginfo@10.23.1-2.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "product": { "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "product_id": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs10-nodejs-docs@10.23.1-2.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch" }, "product_reference": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)", "product_id": "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch" }, "product_reference": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)", "product_id": "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6-7.7.Z" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch" }, "product_reference": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64" }, "product_reference": "rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch" }, "product_reference": "rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" }, "product_reference": "rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7608", "cwe": { "id": "CWE-267", "name": "Privilege Defined With Unsafe Actions" }, "discovery_date": "2020-05-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1840004" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-yargs-parser: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7608" }, { "category": "external", "summary": "RHBZ#1840004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7608", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7608" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608" } ], "release_date": "2020-03-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-yargs-parser: prototype pollution vulnerability" }, { "cve": "CVE-2020-7754", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1892430" } ], "notes": [ { "category": "description", "text": "This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat Enterprise Linux 8 and Software Collections, `npm-user-validate` is used exclusively for `npm`. As a result, this vulnerability is considered Low in such a context.\n\nIn OpenShift Container Platform (OCP) 3.11 and 4.4 the kibana package has been marked Low (similar to RHEL8) as it is primarily used for npm and is protected via OpenShift OAuth. Additionally, whilst OCP 4.4 does deliver the kibana package, due to the code changing to container first content, it has been marked as wontfix at this time and may be fixed in a future release. \n\nAdditionally, the openshift4/ose-logging-kibana6 container is not represented on the CVE page as it gets npm from the Red Hat Software Collections and as such the ose-logging-kibana6 container will be updated when the rh-nodejs10-nodejs package is.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7754" }, { "category": "external", "summary": "RHBZ#1892430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892430" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7754", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7754" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7754", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7754" }, { "category": "external", "summary": "https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p", "url": "https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p" } ], "release_date": "2020-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS" }, { "cve": "CVE-2020-7774", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2020-11-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1898680" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n\u0027s locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-y18n: prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and OpenShift distributed tracing the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-y18n library to authenticated users only, therefore the impact is Low.\n\nIn Red Hat OpenShift Container Storage 4 the noobaa-core container includes the affected version of y18n as a dependency of yargs. However, no unsafe usage found where the module accepts untrusted input and hence this issue has been rated as having a security impact of Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7774" }, { "category": "external", "summary": "RHBZ#1898680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7774", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7774" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887", "url": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887" } ], "release_date": "2020-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-y18n: prototype pollution vulnerability" }, { "cve": "CVE-2020-7788", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-12-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1907444" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ini: Prototype pollution via malicious INI file", "title": "Vulnerability summary" }, { "category": "other", "text": "Node.JS packages in Red Hat Enterprise Linux and Red Hat Software Collections included the vulnerable dependency packaged in \"nodejs-npm\" component. Processing malicious files using npm could potentially trigger this vulnerability. The \"ini\" package bundled with npm was not in the library path where it could be included directly in other programs.\n\nThe nodejs-nodemon packages in Red Hat Enterprise Linux and Red Hat Software Collections are affected by this vulnerability as they bundle the nodejs-ini library. Usage of that library is governed by nodemon itself, so applications started by nodemon are not impacted. Further, nodemon is a developer tool not intended to be used in production.\n\nThe ini package is included in Red Hat Quay by protractor and webpack-cli, both of which are dev dependencies.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7788" }, { "category": "external", "summary": "RHBZ#1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7788", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7788" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788" } ], "release_date": "2020-12-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ini: Prototype pollution via malicious INI file" }, { "cve": "CVE-2020-8116", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-08-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1868196" } ], "notes": [ { "category": "description", "text": "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-dot-prop: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8116" }, { "category": "external", "summary": "RHBZ#1868196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8116", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8116" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116" }, { "category": "external", "summary": "https://hackerone.com/reports/719856", "url": "https://hackerone.com/reports/719856" } ], "release_date": "2020-01-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-dot-prop: prototype pollution" }, { "cve": "CVE-2020-8252", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-09-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1879315" } ], "notes": [ { "category": "description", "text": "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "libuv: buffer overflow in realpath", "title": "Vulnerability summary" }, { "category": "other", "text": "As shipped in Red Hat Software Collections (nodejs-10 \u0026 nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8252" }, { "category": "external", "summary": "RHBZ#1879315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8252", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8252" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252" } ], "release_date": "2020-09-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libuv: buffer overflow in realpath" }, { "cve": "CVE-2020-8265", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2021-01-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1912854" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: use-after-free in the TLS implementation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8265" }, { "category": "external", "summary": "RHBZ#1912854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912854" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8265", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8265" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8265", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8265" }, { "category": "external", "summary": "https://hackerone.com/reports/988103", "url": "https://hackerone.com/reports/988103" } ], "release_date": "2021-01-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: use-after-free in the TLS implementation" }, { "cve": "CVE-2020-8287", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-01-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1912863" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP request smuggling via two copies of a header field in an http request", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8287" }, { "category": "external", "summary": "RHBZ#1912863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912863" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8287", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8287" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8287", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8287" } ], "release_date": "2021-01-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: HTTP request smuggling via two copies of a header field in an http request" }, { "cve": "CVE-2020-15095", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2020-07-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1856875" } ], "notes": [ { "category": "description", "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.", "title": "Vulnerability description" }, { "category": "summary", "text": "npm: sensitive information exposure through logs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15095" }, { "category": "external", "summary": "RHBZ#1856875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15095", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15095" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095" } ], "release_date": "2020-07-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" }, { "category": "workaround", "details": "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm: sensitive information exposure through logs" }, { "cve": "CVE-2020-15366", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1857977" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-ajv library to authenticated users only, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15366" }, { "category": "external", "summary": "RHBZ#1857977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15366", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15366" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-AJV-584908", "url": "https://snyk.io/vuln/SNYK-JS-AJV-584908" } ], "release_date": "2020-07-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-02-15T18:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0521" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.6.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6-7.7.Z:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Server-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Server-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.src", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-debuginfo-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-devel-0:10.23.1-2.el7.x86_64", "7Workstation-RHSCL-3.6:rh-nodejs10-nodejs-docs-0:10.23.1-2.el7.noarch", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.ppc64le", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.s390x", "7Workstation-RHSCL-3.6:rh-nodejs10-npm-0:6.14.10-10.23.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function" } ] }
gsd-2020-8252
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2020-8252", "description": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.", "id": "GSD-2020-8252", "references": [ "https://www.suse.com/security/cve/CVE-2020-8252.html", "https://access.redhat.com/errata/RHSA-2021:0548", "https://access.redhat.com/errata/RHSA-2021:0521", "https://access.redhat.com/errata/RHSA-2020:5086", "https://access.redhat.com/errata/RHSA-2020:4903", "https://access.redhat.com/errata/RHSA-2020:4272", "https://ubuntu.com/security/CVE-2020-8252", "https://advisories.mageia.org/CVE-2020-8252.html", "https://linux.oracle.com/cve/CVE-2020-8252.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2020-8252" ], "details": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.", "id": "GSD-2020-8252", "modified": "2023-12-13T01:21:54.024407Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "support@hackerone.com", "ID": "CVE-2020-8252", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "https://github.com/nodejs/node", "version": { "version_data": [ { "version_value": "Fixed in 10.22.1, 12.18.4, 14.9.0" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Classic Buffer Overflow (CWE-120)" } ] } ] }, "references": { "reference_data": [ { "name": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/", "refsource": "MISC", "url": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/" }, { "name": "https://hackerone.com/reports/965914", "refsource": "MISC", "url": "https://hackerone.com/reports/965914" }, { "name": "GLSA-202009-15", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202009-15" }, { "name": "USN-4548-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4548-1/" }, { "name": "openSUSE-SU-2020:1616", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html" }, { "name": "https://security.netapp.com/advisory/ntap-20201009-0004/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20201009-0004/" }, { "name": "openSUSE-SU-2020:1660", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html" }, { "name": "FEDORA-2020-43d5a372fc", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe_name": [], "versionEndExcluding": "14.9.0", "versionStartIncluding": "14.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "cpe_name": [], "versionEndExcluding": "12.18.4", "versionStartIncluding": "12.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "cpe_name": [], "versionEndExcluding": "10.22.1", "versionStartIncluding": "10.0.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve-assignments@hackerone.com", "ID": "CVE-2020-8252" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-120" } ] } ] }, "references": { "reference_data": [ { "name": "https://hackerone.com/reports/965914", "refsource": "MISC", "tags": [ "Permissions Required", "Third Party Advisory" ], "url": "https://hackerone.com/reports/965914" }, { "name": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/", "refsource": "MISC", "tags": [ "Vendor Advisory" ], "url": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/" }, { "name": "GLSA-202009-15", "refsource": "GENTOO", "tags": [ "Third Party Advisory" ], "url": "https://security.gentoo.org/glsa/202009-15" }, { "name": "USN-4548-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/4548-1/" }, { "name": "openSUSE-SU-2020:1616", "refsource": "SUSE", "tags": [ "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html" }, { "name": "https://security.netapp.com/advisory/ntap-20201009-0004/", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://security.netapp.com/advisory/ntap-20201009-0004/" }, { "name": "openSUSE-SU-2020:1660", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html" }, { "name": "FEDORA-2020-43d5a372fc", "refsource": "FEDORA", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9 } }, "lastModifiedDate": "2022-05-24T17:16Z", "publishedDate": "2020-09-18T21:15Z" } } }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.