csaf_redhat - rhsa-2020

rhsa-2020_5499

Vulnerability from csaf_redhat

Published

2020-12-15 17:27

Modified

2024-11-15 09:38

Summary

Red Hat Security Advisory: nodejs:12 security and bug fix update

Notes

Topic

An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774) * c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277) * nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2020:5499",
        "url": "https://access.redhat.com/errata/RHSA-2020:5499"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1857977",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977"
      },
      {
        "category": "external",
        "summary": "1898554",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898554"
      },
      {
        "category": "external",
        "summary": "1898680",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5499.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs:12 security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-15T09:38:41+00:00",
      "generator": {
        "date": "2024-11-15T09:38:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2020:5499",
      "initial_release_date": "2020-12-15T17:27:36+00:00",
      "revision_history": [
        {
          "date": "2020-12-15T17:27:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-12-15T17:27:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T09:38:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.3.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs:12:8030020201124152102:229f0a1c",
                "product": {
                  "name": "nodejs:12:8030020201124152102:229f0a1c",
                  "product_id": "nodejs:12:8030020201124152102:229f0a1c",
                  "product_identification_helper": {
                    "purl": "pkg:rpmmod/redhat/nodejs@12:8030020201124152102:229f0a1c"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
                "product": {
                  "name": "nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
                  "product_id": "nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
                "product": {
                  "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
                  "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
                "product": {
                  "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
                  "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
                "product": {
                  "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
                  "product_id": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
                "product": {
                  "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
                  "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
                "product": {
                  "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
                  "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                "product": {
                  "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_id": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                "product": {
                  "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_id": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                "product": {
                  "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_id": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                "product": {
                  "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_id": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                "product": {
                  "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_id": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64",
                "product": {
                  "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_id": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.8-1.12.19.1.1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                "product": {
                  "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_id": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                "product": {
                  "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_id": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                "product": {
                  "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_id": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                "product": {
                  "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_id": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                "product": {
                  "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_id": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
                "product": {
                  "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_id": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.8-1.12.19.1.1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                "product": {
                  "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_id": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                "product": {
                  "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_id": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                "product": {
                  "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_id": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                "product": {
                  "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_id": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                "product": {
                  "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_id": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                "product": {
                  "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_id": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.8-1.12.19.1.1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                "product": {
                  "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_id": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                "product": {
                  "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_id": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                "product": {
                  "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_id": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                "product": {
                  "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_id": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                "product": {
                  "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_id": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.19.1-1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
                "product": {
                  "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_id": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@6.14.8-1.12.19.1.1.module%2Bel8.3.0%2B8851%2Bb7b41ca0?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
        },
        "product_reference": "nodejs:12:8030020201124152102:229f0a1c",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64"
        },
        "product_reference": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le"
        },
        "product_reference": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x"
        },
        "product_reference": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src"
        },
        "product_reference": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64"
        },
        "product_reference": "nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64"
        },
        "product_reference": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le"
        },
        "product_reference": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x"
        },
        "product_reference": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64"
        },
        "product_reference": "nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64"
        },
        "product_reference": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le"
        },
        "product_reference": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x"
        },
        "product_reference": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64"
        },
        "product_reference": "nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64"
        },
        "product_reference": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le"
        },
        "product_reference": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x"
        },
        "product_reference": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64"
        },
        "product_reference": "nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch"
        },
        "product_reference": "nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64"
        },
        "product_reference": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le"
        },
        "product_reference": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x"
        },
        "product_reference": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64"
        },
        "product_reference": "nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch"
        },
        "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src"
        },
        "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch"
        },
        "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src"
        },
        "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64"
        },
        "product_reference": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le"
        },
        "product_reference": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x"
        },
        "product_reference": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64 as a component of nodejs:12:8030020201124152102:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
        },
        "product_reference": "npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-7608",
      "cwe": {
        "id": "CWE-267",
        "name": "Privilege Defined With Unsafe Actions"
      },
      "discovery_date": "2020-05-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1840004"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-yargs-parser: prototype pollution vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-7608"
        },
        {
          "category": "external",
          "summary": "RHBZ#1840004",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7608",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-7608"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608"
        }
      ],
      "release_date": "2020-03-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-12-15T17:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:5499"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs-yargs-parser: prototype pollution vulnerability"
    },
    {
      "cve": "CVE-2020-7774",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2020-11-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1898680"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n\u0027s locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-y18n: prototype pollution vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and OpenShift distributed tracing the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-y18n library to authenticated users only, therefore the impact is Low.\n\nIn Red Hat OpenShift Container Storage 4 the noobaa-core container includes the affected version of y18n as a dependency of yargs. However, no unsafe usage found where the module accepts untrusted input and hence this issue has been rated as having a security impact of Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-7774"
        },
        {
          "category": "external",
          "summary": "RHBZ#1898680",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898680"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7774",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-7774"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7774"
        },
        {
          "category": "external",
          "summary": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887",
          "url": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887"
        }
      ],
      "release_date": "2020-10-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-12-15T17:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:5499"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs-y18n: prototype pollution vulnerability"
    },
    {
      "cve": "CVE-2020-8277",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2020-11-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1898554"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions \u003c 15.2.1, \u003c 14.15.1, and \u003c 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8277"
        },
        {
          "category": "external",
          "summary": "RHBZ#1898554",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898554"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8277",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8277"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8277",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8277"
        }
      ],
      "release_date": "2020-11-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-12-15T17:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:5499"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS"
    },
    {
      "cve": "CVE-2020-15366",
      "cwe": {
        "id": "CWE-471",
        "name": "Modification of Assumed-Immutable Data (MAID)"
      },
      "discovery_date": "2020-07-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1857977"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-ajv library to authenticated users only, therefore the impact is low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
          "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-15366"
        },
        {
          "category": "external",
          "summary": "RHBZ#1857977",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15366",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-15366"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366"
        },
        {
          "category": "external",
          "summary": "https://snyk.io/vuln/SNYK-JS-AJV-584908",
          "url": "https://snyk.io/vuln/SNYK-JS-AJV-584908"
        }
      ],
      "release_date": "2020-07-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-12-15T17:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:5499"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debuginfo-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-debugsource-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-devel-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-docs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-full-i18n-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.x86_64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.aarch64",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.ppc64le",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.s390x",
            "AppStream-8.3.0.Z.MAIN:nodejs:12:8030020201124152102:229f0a1c:npm-1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function"
    }
  ]
}

cve-2020-7774

Vulnerability from cvelistv5

Published

2020-11-17 12:30

Modified

2024-09-16 20:13

Severity ?

7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

Summary

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

References

▼	URL	Tags
	https://snyk.io/vuln/SNYK-JS-Y18N-1021887
	https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306
	https://github.com/yargs/y18n/pull/108
	https://github.com/yargs/y18n/issues/96
	https://www.oracle.com/security-alerts/cpuApr2021.html
	https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Impacted products

Vendor

Product

Version

▼

n/a

y18n

Version: unspecified < 5.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:41:01.338Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yargs/y18n/pull/108"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yargs/y18n/issues/96"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "y18n",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "5.0.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "po6ix"
        }
      ],
      "datePublic": "2020-11-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 6.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Prototype Pollution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-14T00:00:00",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "url": "https://snyk.io/vuln/SNYK-JS-Y18N-1021887"
        },
        {
          "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306"
        },
        {
          "url": "https://github.com/yargs/y18n/pull/108"
        },
        {
          "url": "https://github.com/yargs/y18n/issues/96"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        }
      ],
      "title": "Prototype Pollution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2020-7774",
    "datePublished": "2020-11-17T12:30:20.482040Z",
    "dateReserved": "2020-01-21T00:00:00",
    "dateUpdated": "2024-09-16T20:13:29.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-7608

Vulnerability from cvelistv5

Published

2020-03-16 19:49

Modified

2024-08-04 09:33

Severity ?

Summary

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

References

▼	URL	Tags
	https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

n/a

yargs-parser

Version: All versions prior to version 18.1.1 and patches at 13.1.2 and 15.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:33:19.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yargs-parser",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to version 18.1.1 and patches at 13.1.2 and 15.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Prototype Pollution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-16T19:49:49",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "ID": "CVE-2020-7608",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yargs-parser",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to version 18.1.1 and patches at 13.1.2 and 15.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Prototype Pollution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2020-7608",
    "datePublished": "2020-03-16T19:49:49",
    "dateReserved": "2020-01-21T00:00:00",
    "dateUpdated": "2024-08-04T09:33:19.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-15366

Vulnerability from cvelistv5

Published

2020-07-15 19:14

Modified

2024-08-04 13:15

Severity ?

Summary

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

References

▼	URL	Tags
	https://hackerone.com/bugs?subject=user&report_id=894259
	https://github.com/ajv-validator/ajv/tags
	https://github.com/ajv-validator/ajv/releases/tag/v6.12.3
	https://security.netapp.com/advisory/ntap-20240621-0007/

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:15:20.438Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/bugs?subject=user\u0026report_id=894259"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ajv-validator/ajv/tags"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ajv-validator/ajv/releases/tag/v6.12.3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:08:28.352888",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://hackerone.com/bugs?subject=user\u0026report_id=894259"
        },
        {
          "url": "https://github.com/ajv-validator/ajv/tags"
        },
        {
          "url": "https://github.com/ajv-validator/ajv/releases/tag/v6.12.3"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0007/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-15366",
    "datePublished": "2020-07-15T19:14:07",
    "dateReserved": "2020-06-29T00:00:00",
    "dateUpdated": "2024-08-04T13:15:20.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-8277

Vulnerability from cvelistv5

Published

2020-11-19 00:32

Modified

2024-08-04 09:56

Severity ?

Summary

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

References

▼	URL	Tags
	https://hackerone.com/reports/1033107	x_refsource_MISC
	https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202012-11	vendor-advisory, x_refsource_GENTOO
	https://security.gentoo.org/glsa/202101-07	vendor-advisory, x_refsource_GENTOO
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

n/a

https://github.com/nodejs/node

Version: Fixed in 15.2.1, 14.15.1, 12.19.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:56:28.290Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1033107"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/"
          },
          {
            "name": "FEDORA-2020-7473744de1",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/"
          },
          {
            "name": "FEDORA-2020-307e873389",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/"
          },
          {
            "name": "GLSA-202012-11",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202012-11"
          },
          {
            "name": "GLSA-202101-07",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-07"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "name": "FEDORA-2021-afed2b904e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/"
          },
          {
            "name": "FEDORA-2021-ee913722db",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/nodejs/node",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 15.2.1, 14.15.1, 12.19.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions \u003c 15.2.1, \u003c 14.15.1, and \u003c 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Denial of Service (CWE-400)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-19T23:23:25",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1033107"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/"
        },
        {
          "name": "FEDORA-2020-7473744de1",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/"
        },
        {
          "name": "FEDORA-2020-307e873389",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/"
        },
        {
          "name": "GLSA-202012-11",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202012-11"
        },
        {
          "name": "GLSA-202101-07",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-07"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "name": "FEDORA-2021-afed2b904e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/"
        },
        {
          "name": "FEDORA-2021-ee913722db",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2020-8277",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "https://github.com/nodejs/node",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed in 15.2.1, 14.15.1, 12.19.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions \u003c 15.2.1, \u003c 14.15.1, and \u003c 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service (CWE-400)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/1033107",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/1033107"
            },
            {
              "name": "https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/"
            },
            {
              "name": "FEDORA-2020-7473744de1",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/"
            },
            {
              "name": "FEDORA-2020-307e873389",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/"
            },
            {
              "name": "GLSA-202012-11",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202012-11"
            },
            {
              "name": "GLSA-202101-07",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-07"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "FEDORA-2021-afed2b904e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/"
            },
            {
              "name": "FEDORA-2021-ee913722db",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2020-8277",
    "datePublished": "2020-11-19T00:32:13",
    "dateReserved": "2020-01-28T00:00:00",
    "dateUpdated": "2024-08-04T09:56:28.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2020_5499

Vulnerability from csaf_redhat

cve-2020-7774

Vulnerability from cvelistv5

cve-2020-7608

Vulnerability from cvelistv5

cve-2020-15366

Vulnerability from cvelistv5

cve-2020-8277

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature