rhsa-2021_0548
Vulnerability from csaf_redhat
Published
2021-02-16 14:25
Modified
2024-11-15 09:39
Summary
Red Hat Security Advisory: nodejs:10 security update
Notes
Topic
An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (10.23.1).
Security Fix(es):
* libuv: buffer overflow in realpath (CVE-2020-8252)
* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs-dot-prop: prototype pollution (CVE-2020-8116)
* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
* npm: sensitive information exposure through logs (CVE-2020-15095)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2021:0548", url: "https://access.redhat.com/errata/RHSA-2021:0548", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1840004", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1840004", }, { category: "external", summary: "1856875", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1856875", }, { category: "external", summary: "1857977", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1857977", }, { category: "external", summary: "1868196", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1868196", }, { category: "external", summary: "1879315", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1879315", }, { category: "external", summary: "1892430", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1892430", }, { category: "external", summary: "1898680", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1898680", }, { category: "external", summary: "1907444", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1907444", }, { category: "external", summary: "1912854", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1912854", }, { category: "external", summary: "1912863", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1912863", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0548.json", }, ], title: "Red Hat Security Advisory: nodejs:10 security update", tracking: { current_release_date: "2024-11-15T09:39:41+00:00", generator: { date: "2024-11-15T09:39:41+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2021:0548", initial_release_date: "2021-02-16T14:25:46+00:00", revision_history: [ { date: "2021-02-16T14:25:46+00:00", number: "1", summary: "Initial version", }, { date: "2021-02-16T14:25:46+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-15T09:39:41+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream (v. 8)", product: { name: "Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_linux:8::appstream", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "nodejs:10:8030020210118191659:229f0a1c", product: { name: "nodejs:10:8030020210118191659:229f0a1c", product_id: "nodejs:10:8030020210118191659:229f0a1c", product_identification_helper: { purl: "pkg:rpmmod/redhat/nodejs@10:8030020210118191659:229f0a1c", }, }, }, { category: "product_version", name: "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", product: { name: "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", product_id: "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-docs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=noarch&epoch=1", }, }, }, { category: "product_version", name: "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", product: { name: "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", product_id: "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8%2B2632%2B6c5111ed?arch=noarch", }, }, }, { category: "product_version", name: "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", product: { name: "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", product_id: "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8%2B2873%2Baa7dfd9a?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_version", name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product: { name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product_id: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64&epoch=1", }, }, }, { category: "product_version", name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product: { name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product_id: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64&epoch=1", }, }, }, { category: "product_version", name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product: { name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product_id: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64&epoch=1", }, }, }, { category: "product_version", name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product: { name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product_id: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64&epoch=1", }, }, }, { category: "product_version", name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product: { name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product_id: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64&epoch=1", }, }, }, { category: "product_version", name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", product: { name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", product_id: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=aarch64&epoch=1", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", product: { name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", product_id: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=src&epoch=1", }, }, }, { category: "product_version", name: "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", product: { name: "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", product_id: "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8%2B2632%2B6c5111ed?arch=src", }, }, }, { category: "product_version", name: "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", product: { name: "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", product_id: "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8%2B2873%2Baa7dfd9a?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product: { name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product_id: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le&epoch=1", }, }, }, { category: "product_version", name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product: { name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product_id: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le&epoch=1", }, }, }, { category: "product_version", name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product: { name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product_id: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le&epoch=1", }, }, }, { category: "product_version", name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product: { name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product_id: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le&epoch=1", }, }, }, { category: "product_version", name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product: { name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product_id: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le&epoch=1", }, }, }, { category: "product_version", name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", product: { name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", product_id: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", product_identification_helper: { purl: "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=ppc64le&epoch=1", }, }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product: { name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product_id: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product: { name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product_id: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product: { name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product_id: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product: { name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product_id: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product: { name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product_id: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", product: { name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", product_id: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=s390x&epoch=1", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product: { name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product_id: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product: { name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product_id: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-debuginfo@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product: { name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product_id: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-debugsource@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product: { name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product_id: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-devel@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product: { name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product_id: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/nodejs-full-i18n@10.23.1-1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", product: { name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", product_id: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/npm@6.14.10-1.10.23.1.1.module%2Bel8.3.0%2B9502%2B012d8a97?arch=x86_64&epoch=1", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, product_reference: "nodejs:10:8030020210118191659:229f0a1c", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", }, product_reference: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", }, product_reference: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", }, product_reference: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", }, product_reference: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", }, product_reference: "nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", }, product_reference: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", }, product_reference: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", }, product_reference: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", }, product_reference: "nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", }, product_reference: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", }, product_reference: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", }, product_reference: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", }, product_reference: "nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", }, product_reference: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", }, product_reference: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", }, product_reference: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", }, product_reference: "nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", }, product_reference: "nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", }, product_reference: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", }, product_reference: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", }, product_reference: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", }, product_reference: "nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", }, product_reference: "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", }, product_reference: "nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", }, product_reference: "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", }, product_reference: "nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", }, product_reference: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", }, product_reference: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", }, product_reference: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, { category: "default_component_of", full_product_name: { name: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64 as a component of nodejs:10:8030020210118191659:229f0a1c as a component of Red Hat Enterprise Linux AppStream (v. 8)", product_id: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", }, product_reference: "npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", relates_to_product_reference: "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", }, ], }, vulnerabilities: [ { cve: "CVE-2020-7608", cwe: { id: "CWE-267", name: "Privilege Defined With Unsafe Actions", }, discovery_date: "2020-05-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1840004", }, ], notes: [ { category: "description", text: "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", title: "Vulnerability description", }, { category: "summary", text: "nodejs-yargs-parser: prototype pollution vulnerability", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2020-7608", }, { category: "external", summary: "RHBZ#1840004", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1840004", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2020-7608", url: "https://www.cve.org/CVERecord?id=CVE-2020-7608", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-7608", url: "https://nvd.nist.gov/vuln/detail/CVE-2020-7608", }, ], release_date: "2020-03-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2021-02-16T14:25:46+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2021:0548", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", version: "3.1", }, products: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "nodejs-yargs-parser: prototype pollution vulnerability", }, { cve: "CVE-2020-7754", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2020-10-18T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1892430", }, ], notes: [ { category: "description", text: "This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.", title: "Vulnerability description", }, { category: "summary", text: "nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS", title: "Vulnerability summary", }, { category: "other", text: "In Red Hat Enterprise Linux 8 and Software Collections, `npm-user-validate` is used exclusively for `npm`. As a result, this vulnerability is considered Low in such a context.\n\nIn OpenShift Container Platform (OCP) 3.11 and 4.4 the kibana package has been marked Low (similar to RHEL8) as it is primarily used for npm and is protected via OpenShift OAuth. Additionally, whilst OCP 4.4 does deliver the kibana package, due to the code changing to container first content, it has been marked as wontfix at this time and may be fixed in a future release. \n\nAdditionally, the openshift4/ose-logging-kibana6 container is not represented on the CVE page as it gets npm from the Red Hat Software Collections and as such the ose-logging-kibana6 container will be updated when the rh-nodejs10-nodejs package is.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2020-7754", }, { category: "external", summary: "RHBZ#1892430", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1892430", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2020-7754", url: "https://www.cve.org/CVERecord?id=CVE-2020-7754", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-7754", url: "https://nvd.nist.gov/vuln/detail/CVE-2020-7754", }, { category: "external", summary: "https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p", url: "https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p", }, ], release_date: "2020-10-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2021-02-16T14:25:46+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2021:0548", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS", }, { cve: "CVE-2020-7774", cwe: { id: "CWE-915", name: "Improperly Controlled Modification of Dynamically-Determined Object Attributes", }, discovery_date: "2020-11-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1898680", }, ], notes: [ { category: "description", text: "A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n's locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.", title: "Vulnerability description", }, { category: "summary", text: "nodejs-y18n: prototype pollution vulnerability", title: "Vulnerability summary", }, { category: "other", text: "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and OpenShift distributed tracing the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-y18n library to authenticated users only, therefore the impact is Low.\n\nIn Red Hat OpenShift Container Storage 4 the noobaa-core container includes the affected version of y18n as a dependency of yargs. However, no unsafe usage found where the module accepts untrusted input and hence this issue has been rated as having a security impact of Low.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2020-7774", }, { category: "external", summary: "RHBZ#1898680", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1898680", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2020-7774", url: "https://www.cve.org/CVERecord?id=CVE-2020-7774", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-7774", url: "https://nvd.nist.gov/vuln/detail/CVE-2020-7774", }, { category: "external", summary: "https://snyk.io/vuln/SNYK-JS-Y18N-1021887", url: "https://snyk.io/vuln/SNYK-JS-Y18N-1021887", }, ], release_date: "2020-10-25T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2021-02-16T14:25:46+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2021:0548", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 7.3, baseSeverity: "HIGH", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", version: "3.1", }, products: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "nodejs-y18n: prototype pollution vulnerability", }, { cve: "CVE-2020-7788", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2020-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1907444", }, ], notes: [ { category: "description", text: "A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.", title: "Vulnerability description", }, { category: "summary", text: "nodejs-ini: Prototype pollution via malicious INI file", title: "Vulnerability summary", }, { category: "other", text: "Node.JS packages in Red Hat Enterprise Linux and Red Hat Software Collections included the vulnerable dependency packaged in \"nodejs-npm\" component. Processing malicious files using npm could potentially trigger this vulnerability. The \"ini\" package bundled with npm was not in the library path where it could be included directly in other programs.\n\nThe nodejs-nodemon packages in Red Hat Enterprise Linux and Red Hat Software Collections are affected by this vulnerability as they bundle the nodejs-ini library. Usage of that library is governed by nodemon itself, so applications started by nodemon are not impacted. Further, nodemon is a developer tool not intended to be used in production.\n\nThe ini package is included in Red Hat Quay by protractor and webpack-cli, both of which are dev dependencies.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2020-7788", }, { category: "external", summary: "RHBZ#1907444", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1907444", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2020-7788", url: "https://www.cve.org/CVERecord?id=CVE-2020-7788", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-7788", url: "https://nvd.nist.gov/vuln/detail/CVE-2020-7788", }, ], release_date: "2020-12-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2021-02-16T14:25:46+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2021:0548", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 7.3, baseSeverity: "HIGH", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", version: "3.1", }, products: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "nodejs-ini: Prototype pollution via malicious INI file", }, { cve: "CVE-2020-8116", cwe: { id: "CWE-471", name: "Modification of Assumed-Immutable Data (MAID)", }, discovery_date: "2020-08-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1868196", }, ], notes: [ { category: "description", text: "A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", title: "Vulnerability description", }, { category: "summary", text: "nodejs-dot-prop: prototype pollution", title: "Vulnerability summary", }, { category: "other", text: "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.\n\nRed Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2020-8116", }, { category: "external", summary: "RHBZ#1868196", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1868196", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2020-8116", url: "https://www.cve.org/CVERecord?id=CVE-2020-8116", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-8116", url: "https://nvd.nist.gov/vuln/detail/CVE-2020-8116", }, { category: "external", summary: "https://hackerone.com/reports/719856", url: "https://hackerone.com/reports/719856", }, ], release_date: "2020-01-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2021-02-16T14:25:46+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2021:0548", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 7.3, baseSeverity: "HIGH", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", version: "3.1", }, products: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "nodejs-dot-prop: prototype pollution", }, { cve: "CVE-2020-8252", cwe: { id: "CWE-122", name: "Heap-based Buffer Overflow", }, discovery_date: "2020-09-16T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1879315", }, ], notes: [ { category: "description", text: "A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", title: "Vulnerability description", }, { category: "summary", text: "libuv: buffer overflow in realpath", title: "Vulnerability summary", }, { category: "other", text: "As shipped in Red Hat Software Collections (nodejs-10 & nodejs-12) as well as Red Hat Enterprise Linux 8 (nodejs-10 and nodejs-12), no incorrect use of the `UV__PATH_MAX` macro were found. Although the releases of libuv contained in these versions of nodejs are considered \"Affected\", it is considered not feasible to trigger the flaw.\n\nNodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.\n\nRed Hat Enterprise Linux 8 ships libuv-1.23.1, which is not vulnerable to this flaw.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2020-8252", }, { category: "external", summary: "RHBZ#1879315", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1879315", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2020-8252", url: "https://www.cve.org/CVERecord?id=CVE-2020-8252", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-8252", url: "https://nvd.nist.gov/vuln/detail/CVE-2020-8252", }, ], release_date: "2020-09-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2021-02-16T14:25:46+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2021:0548", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "libuv: buffer overflow in realpath", }, { cve: "CVE-2020-8265", cwe: { id: "CWE-416", name: "Use After Free", }, discovery_date: "2021-01-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1912854", }, ], notes: [ { category: "description", text: "A flaw was found in nodejs. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.", title: "Vulnerability description", }, { category: "summary", text: "nodejs: use-after-free in the TLS implementation", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2020-8265", }, { category: "external", summary: "RHBZ#1912854", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1912854", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2020-8265", url: "https://www.cve.org/CVERecord?id=CVE-2020-8265", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-8265", url: "https://nvd.nist.gov/vuln/detail/CVE-2020-8265", }, { category: "external", summary: "https://hackerone.com/reports/988103", url: "https://hackerone.com/reports/988103", }, ], release_date: "2021-01-04T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2021-02-16T14:25:46+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2021:0548", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "nodejs: use-after-free in the TLS implementation", }, { cve: "CVE-2020-8287", cwe: { id: "CWE-444", name: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", }, discovery_date: "2021-01-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1912863", }, ], notes: [ { category: "description", text: "A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity.", title: "Vulnerability description", }, { category: "summary", text: "nodejs: HTTP request smuggling via two copies of a header field in an http request", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2020-8287", }, { category: "external", summary: "RHBZ#1912863", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1912863", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2020-8287", url: "https://www.cve.org/CVERecord?id=CVE-2020-8287", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-8287", url: "https://nvd.nist.gov/vuln/detail/CVE-2020-8287", }, ], release_date: "2021-01-04T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2021-02-16T14:25:46+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2021:0548", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "nodejs: HTTP request smuggling via two copies of a header field in an http request", }, { cve: "CVE-2020-15095", cwe: { id: "CWE-532", name: "Insertion of Sensitive Information into Log File", }, discovery_date: "2020-07-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1856875", }, ], notes: [ { category: "description", text: "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>\". The password value is not redacted and is printed to stdout and also to any generated log files.", title: "Vulnerability description", }, { category: "summary", text: "npm: sensitive information exposure through logs", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2020-15095", }, { category: "external", summary: "RHBZ#1856875", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1856875", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2020-15095", url: "https://www.cve.org/CVERecord?id=CVE-2020-15095", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-15095", url: "https://nvd.nist.gov/vuln/detail/CVE-2020-15095", }, ], release_date: "2020-07-07T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2021-02-16T14:25:46+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2021:0548", }, { category: "workaround", details: "Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 4.4, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "npm: sensitive information exposure through logs", }, { cve: "CVE-2020-15366", cwe: { id: "CWE-471", name: "Modification of Assumed-Immutable Data (MAID)", }, discovery_date: "2020-07-15T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1857977", }, ], notes: [ { category: "description", text: "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.", title: "Vulnerability description", }, { category: "summary", text: "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", title: "Vulnerability summary", }, { category: "other", text: "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-ajv library to authenticated users only, therefore the impact is low.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2020-15366", }, { category: "external", summary: "RHBZ#1857977", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1857977", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2020-15366", url: "https://www.cve.org/CVERecord?id=CVE-2020-15366", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-15366", url: "https://nvd.nist.gov/vuln/detail/CVE-2020-15366", }, { category: "external", summary: "https://snyk.io/vuln/SNYK-JS-AJV-584908", url: "https://snyk.io/vuln/SNYK-JS-AJV-584908", }, ], release_date: "2020-07-04T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2021-02-16T14:25:46+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2021:0548", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.6, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", version: "3.1", }, products: [ "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x", "AppStream-8.3.0.Z.MAIN:nodejs:10:8030020210118191659:229f0a1c:npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.