Moderate: nodejs:12 security and bug fix update
Summary
ALSA-2020:5499: Moderate: nodejs:12 security and bug fix update. Affects nodejs-nodemon across 2 version ranges.
< 1.18.3-1.module_el8.3.0+2023+d2377ea3
< 1.18.3-1.module_el8.3.0+2047+b07ac28e
Fixed in 1.18.3-1.module_el8.3.0+2023+d2377ea3 or 1.18.3-1.module_el8.3.0+2047+b07ac28e, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It provides a runtime environment for executing JavaScript code outside of a web browser. Node.js is widely used for server-side applications and has a large ecosystem of packages available through the npm registry.
Vulnerability Detail
This vulnerability affects Node.js version 12 and is categorized as moderate. It includes the following security issues:
-
nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
- This vulnerability allows an attacker to modify an object's prototype, leading to potential code execution or denial of service.
-
c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)
- This vulnerability can be exploited to cause a denial of service by sending a specially crafted DNS response.
-
nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
- This vulnerability allows an attacker to modify the prototype of objects via a crafted JSON schema, potentially leading to code execution or denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 1.18.3-1.module_el8.3.0+2023+d2377ea31.18.3-1.module_el8.3.0+2023+d2377ea3 -
< 1.18.3-1.module_el8.3.0+2047+b07ac28e1.18.3-1.module_el8.3.0+2047+b07ac28e
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, it is important to update the affected Node.js packages to the fixed versions in order to mitigate the security vulnerabilities. For further support and assistance with vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
Prototype pollution is a vulnerability that allows an attacker to modify an object's prototype, potentially leading to code execution or denial of service.
CVE-2020-7774 is a specific vulnerability in the nodejs-y18n package that allows for prototype pollution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Simply upload your package-lock.json file and Vulert will provide real-time alerts for any open-source vulnerabilities.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related CVE pages, in the 'References' section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
