rhsa-2020_4903
Vulnerability from csaf_redhat
Published
2020-11-04 12:35
Modified
2024-09-13 22:43
Summary
Red Hat Security Advisory: nodejs:12 security and bug fix update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (12.18.4).
Security Fix(es):
* nodejs-dot-prop: prototype pollution (CVE-2020-8116)
* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)
* npm: Sensitive information exposure through logs (CVE-2020-15095)
* libuv: buffer overflow in realpath (CVE-2020-8252)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* The nodejs:12/development module is not installable (BZ#1883965)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.4).\n\nSecurity Fix(es):\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)\n\n* npm: Sensitive information exposure through logs (CVE-2020-15095)\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* The nodejs:12/development module is not installable (BZ#1883965)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:4903",
"url": "https://access.redhat.com/errata/RHSA-2020:4903"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1856875",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875"
},
{
"category": "external",
"summary": "1868196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196"
},
{
"category": "external",
"summary": "1879311",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311"
},
{
"category": "external",
"summary": "1879315",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315"
},
{
"category": "external",
"summary": "1883965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883965"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2020/rhsa-2020_4903.json"
}
],
"title": "Red Hat Security Advisory: nodejs:12 security and bug fix update",
"tracking": {
"current_release_date": "2024-09-13T22:43:08+00:00",
"generator": {
"date": "2024-09-13T22:43:08+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2020:4903",
"initial_release_date": "2020-11-04T12:35:47+00:00",
"revision_history": [
{
"date": "2020-11-04T12:35:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-11-04T12:35:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-13T22:43:08+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:8.1::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs:12:8010020201006223055:c27ad7f8",
"product": {
"name": "nodejs:12:8010020201006223055:c27ad7f8",
"product_id": "nodejs:12:8010020201006223055:c27ad7f8",
"product_identification_helper": {
"purl": "pkg:rpmmod/redhat/nodejs@12:8010020201006223055:c27ad7f8"
}
}
},
{
"category": "product_version",
"name": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"product": {
"name": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"product_id": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-docs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"product": {
"name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"product": {
"name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"product": {
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"product": {
"name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src"
}
}
},
{
"category": "product_version",
"name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"product": {
"name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product": {
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product": {
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product": {
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product": {
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product": {
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64",
"product": {
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64",
"product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=x86_64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product": {
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product": {
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product": {
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product": {
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product": {
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"product": {
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=s390x\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product": {
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product": {
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product": {
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product": {
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product": {
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"product": {
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=ppc64le\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product": {
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product_id": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product": {
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product_id": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product": {
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product_id": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product": {
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product_id": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product": {
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product_id": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@12.18.4-2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"product": {
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"product_id": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/npm@6.14.6-1.12.18.4.2.module%2Bel8.1.0%2B8360%2B14141500?arch=aarch64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "aarch64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
"product_reference": "nodejs:12:8010020201006223055:c27ad7f8",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64"
},
"product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le"
},
"product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x"
},
"product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src"
},
"product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64"
},
"product_reference": "nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64"
},
"product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le"
},
"product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x"
},
"product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64"
},
"product_reference": "nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64"
},
"product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le"
},
"product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x"
},
"product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64"
},
"product_reference": "nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64"
},
"product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le"
},
"product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x"
},
"product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64"
},
"product_reference": "nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch"
},
"product_reference": "nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64"
},
"product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le"
},
"product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x"
},
"product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64"
},
"product_reference": "nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch"
},
"product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src"
},
"product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch"
},
"product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src"
},
"product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64"
},
"product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le"
},
"product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x"
},
"product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64 as a component of nodejs:12:8010020201006223055:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
},
"product_reference": "npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-8116",
"cwe": {
"id": "CWE-471",
"name": "Modification of Assumed-Immutable Data (MAID)"
},
"discovery_date": "2020-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1868196"
}
],
"notes": [
{
"category": "description",
"text": "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-dot-prop: prototype pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8116"
},
{
"category": "external",
"summary": "RHBZ#1868196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8116",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8116"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8116"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/719856",
"url": "https://hackerone.com/reports/719856"
}
],
"release_date": "2020-01-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:4903"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs-dot-prop: prototype pollution"
},
{
"cve": "CVE-2020-8201",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2020-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1879311"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Node.js, where affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This flaw leads to HTTP Request Smuggling as it is a non-standard interpretation of the header. The highest threat from this vulnerability is to confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Node.js is included in Red Hat Quay as a dependency of Yarn, which is only used while building Red Hat Quay, and not during runtime.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8201"
},
{
"category": "external",
"summary": "RHBZ#1879311",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879311"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8201",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8201"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201"
}
],
"release_date": "2020-09-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:4903"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs: HTTP request smuggling due to CR-to-Hyphen conversion"
},
{
"cve": "CVE-2020-8252",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2020-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1879315"
}
],
"notes": [
{
"category": "description",
"text": "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libuv: buffer overflow in realpath",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "As shipped in Red Hat Software Collections (nodejs-10 \u0026 nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8252"
},
{
"category": "external",
"summary": "RHBZ#1879315",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879315"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8252",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8252"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252"
}
],
"release_date": "2020-09-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:4903"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libuv: buffer overflow in realpath"
},
{
"cve": "CVE-2020-15095",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2020-07-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1856875"
}
],
"notes": [
{
"category": "description",
"text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "npm: sensitive information exposure through logs",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-15095"
},
{
"category": "external",
"summary": "RHBZ#1856875",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856875"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-15095",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15095"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15095"
}
],
"release_date": "2020-07-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:4903"
},
{
"category": "workaround",
"details": "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.",
"product_ids": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debuginfo-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-debugsource-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-devel-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-docs-1:12.18.4-2.module+el8.1.0+8360+14141500.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-full-i18n-1:12.18.4-2.module+el8.1.0+8360+14141500.x86_64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.aarch64",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.ppc64le",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.s390x",
"AppStream-8.1.0.Z.EUS:nodejs:12:8010020201006223055:c27ad7f8:npm-1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "npm: sensitive information exposure through logs"
}
]
}
Loading...