{
  "document": {
    "acknowledgments": [
      {
        "organization": "Hitachi Energy",
        "summary": "reporting these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could allow an attacker to eavesdrop on traffic between network source and destination, gain unauthorized access to information, or cause a denial-of-service condition.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Energy",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Switzerland",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-111-03 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-111-03.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-111-03 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-111-03"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Hitachi Energy MicroSCADA Pro/X SYS600",
    "tracking": {
      "current_release_date": "2022-04-21T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-22-111-03",
      "initial_release_date": "2022-04-21T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2022-04-21T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-22-111-03 Hitachi Energy MicroSCADA ProX SYS600"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 10.1.1",
                "product": {
                  "name": " SYS600: Versions 10.1.1 and prior",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": " SYS600"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=9.4 FP1 | \u003e= 10.2.1",
                "product": {
                  "name": " SYS600: Versions 10.1.1 and prior",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": " SYS600"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e= 10.0.0 | \u003c= 10.2.1",
                "product": {
                  "name": " SYS600: Versions 10.1.1 and prior",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": " SYS600"
          }
        ],
        "category": "vendor",
        "name": "Hitachi Energy"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-1968",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The Raccoon attack exploits a flaw in the TLS specification that can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. This would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note this vulnerability only impacts DH ciphersuites and not ECDH ciphersuites. This vulnerability affects OpenSSL 1.0.2, which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).CVE-2020-1968 has been assigned to this vulnerability. A CVSS v3 base score of 3.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1968"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8265",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP request smuggling.CVE-2020-8265 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8265"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8287",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP request smuggling.CVE-2020-8287 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8287"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8201",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack is possible due to a bug in processing of carrier-return symbols in the HTTP header names.CVE-2020-8201 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8201"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8252",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size, which can result in a buffer overflow if the resolved path is longer than 256 bytes.CVE-2020-8252 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8252"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8172",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.CVE-2020-8172 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8172"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8174",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "napi_get_value_string_*() allows various kinds of memory corruption in node \u003c 10.21.0, 12.18.0, and \u003c 14.4.0.CVE-2020-8174 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8174"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-32027",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability was found in postgresql in versions prior to 13.3, 12.7, 11.12, 10.17, and 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.CVE-2021-32027 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32027"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-32028",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.CVE-2021-32028 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32028"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nodejs12",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nodejs12 fixes the following issues:\n\n- nodejs12 was updated to 12.18.4 LTS:\n   - CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-1616",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1616-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:1616-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5CMPMUA4PV5TIZ4ZIY7PTL3KUZIS2IAM/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:1616-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5CMPMUA4PV5TIZ4ZIY7PTL3KUZIS2IAM/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1172686",
        "url": "https://bugzilla.suse.com/1172686"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1173937",
        "url": "https://bugzilla.suse.com/1173937"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176589",
        "url": "https://bugzilla.suse.com/1176589"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176605",
        "url": "https://bugzilla.suse.com/1176605"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15095 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15095/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8201 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8201/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8252 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8252/"
      }
    ],
    "title": "Security update for nodejs12",
    "tracking": {
      "current_release_date": "2020-10-05T04:22:45Z",
      "generator": {
        "date": "2020-10-05T04:22:45Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:1616-1",
      "initial_release_date": "2020-10-05T04:22:45Z",
      "revision_history": [
        {
          "date": "2020-10-05T04:22:45Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
                "product": {
                  "name": "nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
                  "product_id": "nodejs12-docs-12.18.4-lp152.3.6.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs12-12.18.4-lp152.3.6.1.x86_64",
                "product": {
                  "name": "nodejs12-12.18.4-lp152.3.6.1.x86_64",
                  "product_id": "nodejs12-12.18.4-lp152.3.6.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
                "product": {
                  "name": "nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
                  "product_id": "nodejs12-devel-12.18.4-lp152.3.6.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm12-12.18.4-lp152.3.6.1.x86_64",
                "product": {
                  "name": "npm12-12.18.4-lp152.3.6.1.x86_64",
                  "product_id": "npm12-12.18.4-lp152.3.6.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-12.18.4-lp152.3.6.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1.x86_64"
        },
        "product_reference": "nodejs12-12.18.4-lp152.3.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-devel-12.18.4-lp152.3.6.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1.x86_64"
        },
        "product_reference": "nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-docs-12.18.4-lp152.3.6.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1.noarch"
        },
        "product_reference": "nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm12-12.18.4-lp152.3.6.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1.x86_64"
        },
        "product_reference": "npm12-12.18.4-lp152.3.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-15095",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15095"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
          "openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15095",
          "url": "https://www.suse.com/security/cve/CVE-2020-15095"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1173937 for CVE-2020-15095",
          "url": "https://bugzilla.suse.com/1173937"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
            "openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
            "openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-10-05T04:22:45Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-15095"
    },
    {
      "cve": "CVE-2020-8201",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8201"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
          "openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8201",
          "url": "https://www.suse.com/security/cve/CVE-2020-8201"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176605 for CVE-2020-8201",
          "url": "https://bugzilla.suse.com/1176605"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
            "openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
            "openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-10-05T04:22:45Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8201"
    },
    {
      "cve": "CVE-2020-8252",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8252"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
          "openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8252",
          "url": "https://www.suse.com/security/cve/CVE-2020-8252"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176589 for CVE-2020-8252",
          "url": "https://bugzilla.suse.com/1176589"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
            "openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1.noarch",
            "openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-10-05T04:22:45Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8252"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nodejs10",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nodejs10 fixes the following issues:\n\n- nodejs10 was updated to 10.22.1 LTS:\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\t  \n\nThis update was imported from the SUSE:SLE-15:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-1660",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1660-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:1660-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NXR3SXX6RCZ7MMPKWBRQP7QGXO4JN25P/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:1660-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NXR3SXX6RCZ7MMPKWBRQP7QGXO4JN25P/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1172686",
        "url": "https://bugzilla.suse.com/1172686"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1173937",
        "url": "https://bugzilla.suse.com/1173937"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176589",
        "url": "https://bugzilla.suse.com/1176589"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15095 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15095/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8252 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8252/"
      }
    ],
    "title": "Security update for nodejs10",
    "tracking": {
      "current_release_date": "2020-10-12T08:24:04Z",
      "generator": {
        "date": "2020-10-12T08:24:04Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:1660-1",
      "initial_release_date": "2020-10-12T08:24:04Z",
      "revision_history": [
        {
          "date": "2020-10-12T08:24:04Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs10-10.22.1-lp152.2.6.1.i586",
                "product": {
                  "name": "nodejs10-10.22.1-lp152.2.6.1.i586",
                  "product_id": "nodejs10-10.22.1-lp152.2.6.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs10-devel-10.22.1-lp152.2.6.1.i586",
                "product": {
                  "name": "nodejs10-devel-10.22.1-lp152.2.6.1.i586",
                  "product_id": "nodejs10-devel-10.22.1-lp152.2.6.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "npm10-10.22.1-lp152.2.6.1.i586",
                "product": {
                  "name": "npm10-10.22.1-lp152.2.6.1.i586",
                  "product_id": "npm10-10.22.1-lp152.2.6.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs10-docs-10.22.1-lp152.2.6.1.noarch",
                "product": {
                  "name": "nodejs10-docs-10.22.1-lp152.2.6.1.noarch",
                  "product_id": "nodejs10-docs-10.22.1-lp152.2.6.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs10-10.22.1-lp152.2.6.1.x86_64",
                "product": {
                  "name": "nodejs10-10.22.1-lp152.2.6.1.x86_64",
                  "product_id": "nodejs10-10.22.1-lp152.2.6.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs10-devel-10.22.1-lp152.2.6.1.x86_64",
                "product": {
                  "name": "nodejs10-devel-10.22.1-lp152.2.6.1.x86_64",
                  "product_id": "nodejs10-devel-10.22.1-lp152.2.6.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm10-10.22.1-lp152.2.6.1.x86_64",
                "product": {
                  "name": "npm10-10.22.1-lp152.2.6.1.x86_64",
                  "product_id": "npm10-10.22.1-lp152.2.6.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-10.22.1-lp152.2.6.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.i586"
        },
        "product_reference": "nodejs10-10.22.1-lp152.2.6.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-10.22.1-lp152.2.6.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.x86_64"
        },
        "product_reference": "nodejs10-10.22.1-lp152.2.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-devel-10.22.1-lp152.2.6.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.i586"
        },
        "product_reference": "nodejs10-devel-10.22.1-lp152.2.6.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-devel-10.22.1-lp152.2.6.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.x86_64"
        },
        "product_reference": "nodejs10-devel-10.22.1-lp152.2.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-docs-10.22.1-lp152.2.6.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs10-docs-10.22.1-lp152.2.6.1.noarch"
        },
        "product_reference": "nodejs10-docs-10.22.1-lp152.2.6.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm10-10.22.1-lp152.2.6.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.i586"
        },
        "product_reference": "npm10-10.22.1-lp152.2.6.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm10-10.22.1-lp152.2.6.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.x86_64"
        },
        "product_reference": "npm10-10.22.1-lp152.2.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-15095",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15095"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.i586",
          "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.x86_64",
          "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.i586",
          "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.x86_64",
          "openSUSE Leap 15.2:nodejs10-docs-10.22.1-lp152.2.6.1.noarch",
          "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.i586",
          "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15095",
          "url": "https://www.suse.com/security/cve/CVE-2020-15095"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1173937 for CVE-2020-15095",
          "url": "https://bugzilla.suse.com/1173937"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-docs-10.22.1-lp152.2.6.1.noarch",
            "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-docs-10.22.1-lp152.2.6.1.noarch",
            "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-10-12T08:24:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-15095"
    },
    {
      "cve": "CVE-2020-8252",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8252"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.i586",
          "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.x86_64",
          "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.i586",
          "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.x86_64",
          "openSUSE Leap 15.2:nodejs10-docs-10.22.1-lp152.2.6.1.noarch",
          "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.i586",
          "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8252",
          "url": "https://www.suse.com/security/cve/CVE-2020-8252"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176589 for CVE-2020-8252",
          "url": "https://bugzilla.suse.com/1176589"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-docs-10.22.1-lp152.2.6.1.noarch",
            "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:nodejs10-10.22.1-lp152.2.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:nodejs10-devel-10.22.1-lp152.2.6.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-docs-10.22.1-lp152.2.6.1.noarch",
            "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.i586",
            "openSUSE Leap 15.2:npm10-10.22.1-lp152.2.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-10-12T08:24:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8252"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.4).\n\nSecurity Fix(es):\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)\n\n* npm: Sensitive information exposure through logs (CVE-2020-15095)\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* The nodejs:12/development module is not installable (BZ#1883966)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2020:4272",
        "url": "https://access.redhat.com/errata/RHSA-2020:4272"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1856875",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875"
      },
      {
        "category": "external",
        "summary": "1868196",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196"
      },
      {
        "category": "external",
        "summary": "1879311",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311"
      },
      {
        "category": "external",
        "summary": "1879315",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315"
      },
      {
        "category": "external",
        "summary": "1883966",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883966"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4272.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs:12 security and bug fix update",
    "tracking": {
      "current_release_date": "2026-07-18T12:55:11+00:00",
      "generator": {
        "date": "2026-07-18T12:55:11+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2020:4272",
      "initial_release_date": "2020-10-19T14:37:38+00:00",
      "revision_history": [
        {
          "date": "2020-10-19T14:37:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-10-19T14:37:38+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-18T12:55:11+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.2.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
                "product": {
                  "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src (nodejs:12)",
                  "product_id": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=src\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
                "product": {
                  "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src (nodejs:12)",
                  "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
                "product": {
                  "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src (nodejs:12)",
                  "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                "product": {
                  "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12)",
                  "product_id": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                "product": {
                  "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12)",
                  "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                "product": {
                  "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12)",
                  "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                "product": {
                  "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12)",
                  "product_id": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                "product": {
                  "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12)",
                  "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                "product": {
                  "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12)",
                  "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.2.0%2B8361%2B192e434e?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
                "product": {
                  "name": "nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch (nodejs:12)",
                  "product_id": "nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
                "product": {
                  "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch (nodejs:12)",
                  "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
                "product": {
                  "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch (nodejs:12)",
                  "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                "product": {
                  "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x (nodejs:12)",
                  "product_id": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                "product": {
                  "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x (nodejs:12)",
                  "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                "product": {
                  "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x (nodejs:12)",
                  "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                "product": {
                  "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x (nodejs:12)",
                  "product_id": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                "product": {
                  "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x (nodejs:12)",
                  "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                "product": {
                  "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x (nodejs:12)",
                  "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.2.0%2B8361%2B192e434e?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                "product": {
                  "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12)",
                  "product_id": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                "product": {
                  "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12)",
                  "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                "product": {
                  "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12)",
                  "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                "product": {
                  "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12)",
                  "product_id": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                "product": {
                  "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12)",
                  "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                "product": {
                  "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12)",
                  "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.2.0%2B8361%2B192e434e?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                "product": {
                  "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12)",
                  "product_id": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                "product": {
                  "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12)",
                  "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                "product": {
                  "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12)",
                  "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                "product": {
                  "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12)",
                  "product_id": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                "product": {
                  "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12)",
                  "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                "product": {
                  "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12)",
                  "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.2.0%2B8361%2B192e434e?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8020020201007080935:4cda2c84"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12"
        },
        "product_reference": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12"
        },
        "product_reference": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12"
        },
        "product_reference": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12"
        },
        "product_reference": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
        },
        "product_reference": "nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12"
        },
        "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12"
        },
        "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12"
        },
        "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
        },
        "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12"
        },
        "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12"
        },
        "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12"
        },
        "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
        },
        "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12"
        },
        "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12"
        },
        "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12"
        },
        "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
        },
        "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12"
        },
        "product_reference": "nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12"
        },
        "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12"
        },
        "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12"
        },
        "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
        },
        "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12"
        },
        "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12"
        },
        "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12"
        },
        "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12"
        },
        "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12"
        },
        "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12"
        },
        "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12"
        },
        "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
        },
        "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-8116",
      "cwe": {
        "id": "CWE-471",
        "name": "Modification of Assumed-Immutable Data (MAID)"
      },
      "discovery_date": "2020-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1868196"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-dot-prop: prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8116"
        },
        {
          "category": "external",
          "summary": "RHBZ#1868196",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8116",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8116"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/719856",
          "url": "https://hackerone.com/reports/719856"
        }
      ],
      "release_date": "2020-01-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-10-19T14:37:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:4272"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs-dot-prop: prototype pollution"
    },
    {
      "cve": "CVE-2020-8201",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2020-09-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1879311"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js, where affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This flaw leads to HTTP Request Smuggling as it is a non-standard interpretation of the header. The highest threat from this vulnerability is to confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Node.js is included in Red Hat Quay as a dependency of Yarn, which is only used while building Red Hat Quay, and not during runtime.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8201"
        },
        {
          "category": "external",
          "summary": "RHBZ#1879311",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8201",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8201"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201"
        }
      ],
      "release_date": "2020-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-10-19T14:37:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:4272"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion"
    },
    {
      "cve": "CVE-2020-8252",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2020-09-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1879315"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libuv: buffer overflow in realpath",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "As shipped in Red Hat Software Collections (nodejs-10 \u0026 nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8252"
        },
        {
          "category": "external",
          "summary": "RHBZ#1879315",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8252",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8252"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252"
        }
      ],
      "release_date": "2020-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-10-19T14:37:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:4272"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "libuv: buffer overflow in realpath"
    },
    {
      "cve": "CVE-2020-15095",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "discovery_date": "2020-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1856875"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "npm: sensitive information exposure through logs",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
          "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-15095"
        },
        {
          "category": "external",
          "summary": "RHBZ#1856875",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15095",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-15095"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095"
        }
      ],
      "release_date": "2020-07-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-10-19T14:37:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:4272"
        },
        {
          "category": "workaround",
          "details": "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.",
          "product_ids": [
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-devel-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-docs-1:12.18.4-2.module+el8.2.0+8361+192e434e.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.aarch64::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.ppc64le::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.s390x::nodejs:12",
            "AppStream-8.2.0.Z.MAIN.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64::nodejs:12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "npm: sensitive information exposure through logs"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.4).\n\nSecurity Fix(es):\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)\n\n* npm: Sensitive information exposure through logs (CVE-2020-15095)\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* The nodejs:12/development module is not installable (BZ#1883965)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2020:4903",
        "url": "https://access.redhat.com/errata/RHSA-2020:4903"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1856875",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875"
      },
      {
        "category": "external",
        "summary": "1868196",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196"
      },
      {
        "category": "external",
        "summary": "1879311",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311"
      },
      {
        "category": "external",
        "summary": "1879315",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315"
      },
      {
        "category": "external",
        "summary": "1883965",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883965"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4903.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs:12 security and bug fix update",
    "tracking": {
      "current_release_date": "2026-07-18T12:55:15+00:00",
      "generator": {
        "date": "2026-07-18T12:55:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2020:4903",
      "initial_release_date": "2020-11-04T12:35:47+00:00",
      "revision_history": [
        {
          "date": "2020-11-04T12:35:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-11-04T12:35:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-18T12:55:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
                  "product_id": "AppStream-8.1.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:8.1::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
                "product": {
                  "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src (nodejs:12)",
                  "product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=src\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
                "product": {
                  "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src (nodejs:12)",
                  "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
                "product": {
                  "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src (nodejs:12)",
                  "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                "product": {
                  "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12)",
                  "product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                "product": {
                  "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12)",
                  "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                "product": {
                  "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12)",
                  "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                "product": {
                  "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12)",
                  "product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                "product": {
                  "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12)",
                  "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                "product": {
                  "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12)",
                  "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
                "product": {
                  "name": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch (nodejs:12)",
                  "product_id": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
                "product": {
                  "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch (nodejs:12)",
                  "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
                "product": {
                  "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch (nodejs:12)",
                  "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                "product": {
                  "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x (nodejs:12)",
                  "product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                "product": {
                  "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x (nodejs:12)",
                  "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                "product": {
                  "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x (nodejs:12)",
                  "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                "product": {
                  "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x (nodejs:12)",
                  "product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                "product": {
                  "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x (nodejs:12)",
                  "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                "product": {
                  "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x (nodejs:12)",
                  "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                "product": {
                  "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12)",
                  "product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                "product": {
                  "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12)",
                  "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                "product": {
                  "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12)",
                  "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                "product": {
                  "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12)",
                  "product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                "product": {
                  "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12)",
                  "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                "product": {
                  "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12)",
                  "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                "product": {
                  "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12)",
                  "product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                "product": {
                  "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12)",
                  "product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                "product": {
                  "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12)",
                  "product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                "product": {
                  "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12)",
                  "product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                "product": {
                  "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12)",
                  "product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                "product": {
                  "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12)",
                  "product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:12:8010020201006223055:c27ad7f8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12"
        },
        "product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12"
        },
        "product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12"
        },
        "product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12"
        },
        "product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
        },
        "product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12"
        },
        "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12"
        },
        "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12"
        },
        "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
        },
        "product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12"
        },
        "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12"
        },
        "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12"
        },
        "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
        },
        "product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12"
        },
        "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12"
        },
        "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12"
        },
        "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
        },
        "product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12"
        },
        "product_reference": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12"
        },
        "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12"
        },
        "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12"
        },
        "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
        },
        "product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12"
        },
        "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12"
        },
        "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12"
        },
        "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12"
        },
        "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12"
        },
        "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12"
        },
        "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12"
        },
        "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64 (nodejs:12) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
          "product_id": "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
        },
        "product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
        "relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-8116",
      "cwe": {
        "id": "CWE-471",
        "name": "Modification of Assumed-Immutable Data (MAID)"
      },
      "discovery_date": "2020-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1868196"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-dot-prop: prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8116"
        },
        {
          "category": "external",
          "summary": "RHBZ#1868196",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8116",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8116"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/719856",
          "url": "https://hackerone.com/reports/719856"
        }
      ],
      "release_date": "2020-01-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-11-04T12:35:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:4903"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs-dot-prop: prototype pollution"
    },
    {
      "cve": "CVE-2020-8201",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2020-09-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1879311"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js, where affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This flaw leads to HTTP Request Smuggling as it is a non-standard interpretation of the header. The highest threat from this vulnerability is to confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Node.js is included in Red Hat Quay as a dependency of Yarn, which is only used while building Red Hat Quay, and not during runtime.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8201"
        },
        {
          "category": "external",
          "summary": "RHBZ#1879311",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8201",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8201"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201"
        }
      ],
      "release_date": "2020-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-11-04T12:35:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:4903"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion"
    },
    {
      "cve": "CVE-2020-8252",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2020-09-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1879315"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libuv: buffer overflow in realpath",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "As shipped in Red Hat Software Collections (nodejs-10 \u0026 nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8252"
        },
        {
          "category": "external",
          "summary": "RHBZ#1879315",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8252",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8252"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252"
        }
      ],
      "release_date": "2020-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-11-04T12:35:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:4903"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libuv: buffer overflow in realpath"
    },
    {
      "cve": "CVE-2020-15095",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "discovery_date": "2020-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1856875"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "npm: sensitive information exposure through logs",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
          "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
          "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-15095"
        },
        {
          "category": "external",
          "summary": "RHBZ#1856875",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15095",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-15095"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095"
        }
      ],
      "release_date": "2020-07-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-11-04T12:35:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:4903"
        },
        {
          "category": "workaround",
          "details": "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.",
          "product_ids": [
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch::nodejs:12",
            "AppStream-8.1.0.Z.EUS:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x::nodejs:12",
            "AppStream-8.1.0.Z.EUS:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64::nodejs:12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "npm: sensitive information exposure through logs"
    }
  ]
}