csaf_suse - suse-su-2020:2800-1

Vulnerability from csaf_suse

Published

2020-09-30 07:56

Modified

2020-09-30 07:56

Summary

Security update for nodejs8

Notes

Title of the patch

Security update for nodejs8

Description of the patch

This update for nodejs8 fixes the following issues: - CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443). - CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). - CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916) - CVE-2020-15095: Fixed information leak through log files (bsc#1173937). - Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686). - Add Require for nodejs8 when intalling npm8 (bsc#1172728)

Patchnames

SUSE-2020-2800,SUSE-SLE-Module-Web-Scripting-15-SP2-2020-2800

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "critical",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for nodejs8",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for nodejs8 fixes the following issues:\n\n- CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).\n- CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). \n- CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying \n  properties of Object.prototype (bsc#1166916)\n- CVE-2020-15095: Fixed information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686).\n- Add Require for nodejs8 when intalling npm8 (bsc#1172728)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2020-2800,SUSE-SLE-Module-Web-Scripting-15-SP2-2020-2800",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_2800-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2020:2800-1",
            url: "https://www.suse.com/support/update/announcement/2020/suse-su-20202800-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2020:2800-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2020-September/007505.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1166916",
            url: "https://bugzilla.suse.com/1166916",
         },
         {
            category: "self",
            summary: "SUSE Bug 1172442",
            url: "https://bugzilla.suse.com/1172442",
         },
         {
            category: "self",
            summary: "SUSE Bug 1172443",
            url: "https://bugzilla.suse.com/1172443",
         },
         {
            category: "self",
            summary: "SUSE Bug 1172686",
            url: "https://bugzilla.suse.com/1172686",
         },
         {
            category: "self",
            summary: "SUSE Bug 1172728",
            url: "https://bugzilla.suse.com/1172728",
         },
         {
            category: "self",
            summary: "SUSE Bug 1173937",
            url: "https://bugzilla.suse.com/1173937",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-11080 page",
            url: "https://www.suse.com/security/cve/CVE-2020-11080/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-15095 page",
            url: "https://www.suse.com/security/cve/CVE-2020-15095/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-7598 page",
            url: "https://www.suse.com/security/cve/CVE-2020-7598/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-8174 page",
            url: "https://www.suse.com/security/cve/CVE-2020-8174/",
         },
      ],
      title: "Security update for nodejs8",
      tracking: {
         current_release_date: "2020-09-30T07:56:15Z",
         generator: {
            date: "2020-09-30T07:56:15Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2020:2800-1",
         initial_release_date: "2020-09-30T07:56:15Z",
         revision_history: [
            {
               date: "2020-09-30T07:56:15Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs8-8.17.0-10.3.1.aarch64",
                        product: {
                           name: "nodejs8-8.17.0-10.3.1.aarch64",
                           product_id: "nodejs8-8.17.0-10.3.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs8-devel-8.17.0-10.3.1.aarch64",
                        product: {
                           name: "nodejs8-devel-8.17.0-10.3.1.aarch64",
                           product_id: "nodejs8-devel-8.17.0-10.3.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm8-8.17.0-10.3.1.aarch64",
                        product: {
                           name: "npm8-8.17.0-10.3.1.aarch64",
                           product_id: "npm8-8.17.0-10.3.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs8-8.17.0-10.3.1.i586",
                        product: {
                           name: "nodejs8-8.17.0-10.3.1.i586",
                           product_id: "nodejs8-8.17.0-10.3.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs8-devel-8.17.0-10.3.1.i586",
                        product: {
                           name: "nodejs8-devel-8.17.0-10.3.1.i586",
                           product_id: "nodejs8-devel-8.17.0-10.3.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm8-8.17.0-10.3.1.i586",
                        product: {
                           name: "npm8-8.17.0-10.3.1.i586",
                           product_id: "npm8-8.17.0-10.3.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs8-docs-8.17.0-10.3.1.noarch",
                        product: {
                           name: "nodejs8-docs-8.17.0-10.3.1.noarch",
                           product_id: "nodejs8-docs-8.17.0-10.3.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs8-8.17.0-10.3.1.ppc64le",
                        product: {
                           name: "nodejs8-8.17.0-10.3.1.ppc64le",
                           product_id: "nodejs8-8.17.0-10.3.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs8-devel-8.17.0-10.3.1.ppc64le",
                        product: {
                           name: "nodejs8-devel-8.17.0-10.3.1.ppc64le",
                           product_id: "nodejs8-devel-8.17.0-10.3.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm8-8.17.0-10.3.1.ppc64le",
                        product: {
                           name: "npm8-8.17.0-10.3.1.ppc64le",
                           product_id: "npm8-8.17.0-10.3.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs8-8.17.0-10.3.1.s390x",
                        product: {
                           name: "nodejs8-8.17.0-10.3.1.s390x",
                           product_id: "nodejs8-8.17.0-10.3.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs8-devel-8.17.0-10.3.1.s390x",
                        product: {
                           name: "nodejs8-devel-8.17.0-10.3.1.s390x",
                           product_id: "nodejs8-devel-8.17.0-10.3.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm8-8.17.0-10.3.1.s390x",
                        product: {
                           name: "npm8-8.17.0-10.3.1.s390x",
                           product_id: "npm8-8.17.0-10.3.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs8-8.17.0-10.3.1.x86_64",
                        product: {
                           name: "nodejs8-8.17.0-10.3.1.x86_64",
                           product_id: "nodejs8-8.17.0-10.3.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs8-devel-8.17.0-10.3.1.x86_64",
                        product: {
                           name: "nodejs8-devel-8.17.0-10.3.1.x86_64",
                           product_id: "nodejs8-devel-8.17.0-10.3.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm8-8.17.0-10.3.1.x86_64",
                        product: {
                           name: "npm8-8.17.0-10.3.1.x86_64",
                           product_id: "npm8-8.17.0-10.3.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
                        product: {
                           name: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
                           product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-web-scripting:15:sp2",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs8-8.17.0-10.3.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
            },
            product_reference: "nodejs8-8.17.0-10.3.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs8-8.17.0-10.3.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
            },
            product_reference: "nodejs8-8.17.0-10.3.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs8-8.17.0-10.3.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
            },
            product_reference: "nodejs8-8.17.0-10.3.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs8-8.17.0-10.3.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
            },
            product_reference: "nodejs8-8.17.0-10.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs8-devel-8.17.0-10.3.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
            },
            product_reference: "nodejs8-devel-8.17.0-10.3.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs8-devel-8.17.0-10.3.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
            },
            product_reference: "nodejs8-devel-8.17.0-10.3.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs8-devel-8.17.0-10.3.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
            },
            product_reference: "nodejs8-devel-8.17.0-10.3.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs8-devel-8.17.0-10.3.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
            },
            product_reference: "nodejs8-devel-8.17.0-10.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs8-docs-8.17.0-10.3.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
            },
            product_reference: "nodejs8-docs-8.17.0-10.3.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm8-8.17.0-10.3.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
            },
            product_reference: "npm8-8.17.0-10.3.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm8-8.17.0-10.3.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
            },
            product_reference: "npm8-8.17.0-10.3.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm8-8.17.0-10.3.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
            },
            product_reference: "npm8-8.17.0-10.3.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm8-8.17.0-10.3.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
            },
            product_reference: "npm8-8.17.0-10.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP2",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2020-11080",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-11080",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-11080",
               url: "https://www.suse.com/security/cve/CVE-2020-11080",
            },
            {
               category: "external",
               summary: "SUSE Bug 1172441 for CVE-2020-11080",
               url: "https://bugzilla.suse.com/1172441",
            },
            {
               category: "external",
               summary: "SUSE Bug 1172442 for CVE-2020-11080",
               url: "https://bugzilla.suse.com/1172442",
            },
            {
               category: "external",
               summary: "SUSE Bug 1181358 for CVE-2020-11080",
               url: "https://bugzilla.suse.com/1181358",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-30T07:56:15Z",
               details: "important",
            },
         ],
         title: "CVE-2020-11080",
      },
      {
         cve: "CVE-2020-15095",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-15095",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>\". The password value is not redacted and is printed to stdout and also to any generated log files.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-15095",
               url: "https://www.suse.com/security/cve/CVE-2020-15095",
            },
            {
               category: "external",
               summary: "SUSE Bug 1173937 for CVE-2020-15095",
               url: "https://bugzilla.suse.com/1173937",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-30T07:56:15Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-15095",
      },
      {
         cve: "CVE-2020-7598",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-7598",
            },
         ],
         notes: [
            {
               category: "general",
               text: "minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-7598",
               url: "https://www.suse.com/security/cve/CVE-2020-7598",
            },
            {
               category: "external",
               summary: "SUSE Bug 1166916 for CVE-2020-7598",
               url: "https://bugzilla.suse.com/1166916",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-30T07:56:15Z",
               details: "important",
            },
         ],
         title: "CVE-2020-7598",
      },
      {
         cve: "CVE-2020-8174",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-8174",
            },
         ],
         notes: [
            {
               category: "general",
               text: "napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-8174",
               url: "https://www.suse.com/security/cve/CVE-2020-8174",
            },
            {
               category: "external",
               summary: "SUSE Bug 1172443 for CVE-2020-8174",
               url: "https://bugzilla.suse.com/1172443",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.3.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-30T07:56:15Z",
               details: "critical",
            },
         ],
         title: "CVE-2020-8174",
      },
   ],
}

cve-2020-11080

Vulnerability from cvelistv5

Published

2020-06-03 00:00

Modified

2024-08-04 11:21

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

References

▼	URL	Tags
	https://www.debian.org/security/2020/dsa-4696	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/	vendor-advisory
	https://www.oracle.com/security-alerts/cpujul2020.html
	https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr
	https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090
	https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394
	https://www.oracle.com/security-alerts/cpuoct2020.html
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/	vendor-advisory
	https://www.oracle.com/security-alerts/cpujan2021.html
	https://www.oracle.com//security-alerts/cpujul2021.html
	https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html	mailing-list
	https://www.oracle.com/security-alerts/cpuapr2022.html
	https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html	mailing-list

Impacted products

	Vendor	Product	Version
	nghttp2	nghttp2	Version: < 1.41.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T11:21:14.514Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "DSA-4696",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2020/dsa-4696",
               },
               {
                  name: "openSUSE-SU-2020:0802",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html",
               },
               {
                  name: "FEDORA-2020-f7d15c8b77",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
               },
               {
                  name: "FEDORA-2020-43d5a372fc",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2021.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "[debian-lts-announce] 20211017 [SECURITY] [DLA 2786-1] nghttp2 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  name: "[debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "nghttp2",
               vendor: "nghttp2",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.41.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 3.7,
                  baseSeverity: "LOW",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-707",
                     description: "CWE-707 Improper Enforcement of Message or Data Structure",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-16T17:06:24.016570",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "DSA-4696",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2020/dsa-4696",
            },
            {
               name: "openSUSE-SU-2020:0802",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html",
            },
            {
               name: "FEDORA-2020-f7d15c8b77",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               url: "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr",
            },
            {
               url: "https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090",
            },
            {
               url: "https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
            },
            {
               name: "FEDORA-2020-43d5a372fc",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujan2021.html",
            },
            {
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "[debian-lts-announce] 20211017 [SECURITY] [DLA 2786-1] nghttp2 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               name: "[debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
            },
         ],
         source: {
            advisory: "GHSA-q5wr-xfw9-q7xr",
            discovery: "UNKNOWN",
         },
         title: "Denial of service in nghttp2",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2020-11080",
      datePublished: "2020-06-03T00:00:00",
      dateReserved: "2020-03-30T00:00:00",
      dateUpdated: "2024-08-04T11:21:14.514Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-15095

Vulnerability from cvelistv5

Published

2020-07-07 18:55

Modified

2024-08-04 13:08

Severity ?

4.4 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Summary

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

References

▼	URL	Tags
	https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp	x_refsource_CONFIRM
	https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc	x_refsource_MISC
	https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html	vendor-advisory, x_refsource_SUSE
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202101-07	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	npm	cli	Version: < 6.14.6

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T13:08:21.646Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07",
               },
               {
                  name: "openSUSE-SU-2020:1616",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html",
               },
               {
                  name: "openSUSE-SU-2020:1644",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html",
               },
               {
                  name: "openSUSE-SU-2020:1660",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html",
               },
               {
                  name: "FEDORA-2020-43d5a372fc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/",
               },
               {
                  name: "GLSA-202101-07",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-07",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "cli",
               vendor: "npm",
               versions: [
                  {
                     status: "affected",
                     version: "< 6.14.6",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>\". The password value is not redacted and is printed to stdout and also to any generated log files.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-532",
                     description: "CWE-532: Insertion of Sensitive Information into Log File",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-11T10:06:12",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07",
            },
            {
               name: "openSUSE-SU-2020:1616",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html",
            },
            {
               name: "openSUSE-SU-2020:1644",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html",
            },
            {
               name: "openSUSE-SU-2020:1660",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html",
            },
            {
               name: "FEDORA-2020-43d5a372fc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/",
            },
            {
               name: "GLSA-202101-07",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-07",
            },
         ],
         source: {
            advisory: "GHSA-93f3-23rq-pjfp",
            discovery: "UNKNOWN",
         },
         title: "Sensitive information exposure through logs in npm cli",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2020-15095",
               STATE: "PUBLIC",
               TITLE: "Sensitive information exposure through logs in npm cli",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "cli",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 6.14.6",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "npm",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>\". The password value is not redacted and is printed to stdout and also to any generated log files.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-532: Insertion of Sensitive Information into Log File",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp",
                     refsource: "CONFIRM",
                     url: "https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp",
                  },
                  {
                     name: "https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc",
                     refsource: "MISC",
                     url: "https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc",
                  },
                  {
                     name: "https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07",
                     refsource: "MISC",
                     url: "https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07",
                  },
                  {
                     name: "openSUSE-SU-2020:1616",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1644",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1660",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html",
                  },
                  {
                     name: "FEDORA-2020-43d5a372fc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/",
                  },
                  {
                     name: "GLSA-202101-07",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-07",
                  },
               ],
            },
            source: {
               advisory: "GHSA-93f3-23rq-pjfp",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2020-15095",
      datePublished: "2020-07-07T18:55:12",
      dateReserved: "2020-06-25T00:00:00",
      dateUpdated: "2024-08-04T13:08:21.646Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-8174

Vulnerability from cvelistv5

Published

2020-07-24 21:45

Modified

2024-08-04 09:56

Severity ?

Summary

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

References

▼	URL	Tags
	https://hackerone.com/reports/784186	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://security.gentoo.org/glsa/202101-07	vendor-advisory, x_refsource_GENTOO
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20201023-0003/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	https://github.com/nodejs/node	Version: 10.21.0,12.18.0,14.4.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T09:56:26.828Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/784186",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
               },
               {
                  name: "GLSA-202101-07",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-07",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2021.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20201023-0003/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "https://github.com/nodejs/node",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "10.21.0,12.18.0,14.4.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-119",
                     description: "Memory Corruption - Generic (CWE-119)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-04-19T23:23:21",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://hackerone.com/reports/784186",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
            },
            {
               name: "GLSA-202101-07",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-07",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2021.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20201023-0003/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "support@hackerone.com",
               ID: "CVE-2020-8174",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "https://github.com/nodejs/node",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "10.21.0,12.18.0,14.4.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Memory Corruption - Generic (CWE-119)",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://hackerone.com/reports/784186",
                     refsource: "MISC",
                     url: "https://hackerone.com/reports/784186",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
                  },
                  {
                     name: "GLSA-202101-07",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-07",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2021.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20201023-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20201023-0003/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2020-8174",
      datePublished: "2020-07-24T21:45:37",
      dateReserved: "2020-01-28T00:00:00",
      dateUpdated: "2024-08-04T09:56:26.828Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-7598

Vulnerability from cvelistv5

Published

2020-03-11 21:40

Modified

2024-08-04 09:33

Severity ?

Summary

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

References

▼	URL	Tags
	https://snyk.io/vuln/SNYK-JS-MINIMIST-559764	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	minimist	Version: All versions prior to version 1.2.2

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T09:33:19.947Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764",
               },
               {
                  name: "openSUSE-SU-2020:0802",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "minimist",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "All versions prior to version 1.2.2",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Prototype Pollution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-06-13T09:11:57",
            orgId: "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
            shortName: "snyk",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764",
            },
            {
               name: "openSUSE-SU-2020:0802",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "report@snyk.io",
               ID: "CVE-2020-7598",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "minimist",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "All versions prior to version 1.2.2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Prototype Pollution",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764",
                     refsource: "MISC",
                     url: "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764",
                  },
                  {
                     name: "openSUSE-SU-2020:0802",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
      assignerShortName: "snyk",
      cveId: "CVE-2020-7598",
      datePublished: "2020-03-11T21:40:09",
      dateReserved: "2020-01-21T00:00:00",
      dateUpdated: "2024-08-04T09:33:19.947Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

cve-2020-11080

Vulnerability from cvelistv5

cve-2020-15095

Vulnerability from cvelistv5

cve-2020-8174

Vulnerability from cvelistv5

cve-2020-7598

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature