Moderate: nodejs:12 security update
Summary
ALSA-2021:0549: Moderate: nodejs:12 security update. Affects nodejs-nodemon versions < 2.0.3-1.module_el8.4.0+2521+c668cc9f. Fixed in 2.0.3-1.module_el8.4.0+2521+c668cc9f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications. The vulnerability affects the nodejs package version 12.20.1 and the nodejs-nodemon package version 2.0.3. These packages have been upgraded to address the security issues.
Vulnerability Detail
The vulnerability includes several security issues:
-
Prototype pollution in function mixin-deep (CVE-2019-10746): This vulnerability allows an attacker to modify the prototype of an object, leading to potential code execution or denial of service.
-
Prototype pollution in function set-value (CVE-2019-10747): Similar to the previous vulnerability, this allows an attacker to modify the prototype of an object, leading to potential code execution or denial of service.
-
Improper input validation in nodejs-npm-user-validate (CVE-2020-7754): This vulnerability allows an attacker to perform a regular expression denial of service (ReDoS) attack by providing a specially crafted email address.
-
Prototype pollution via malicious INI file in nodejs-ini (CVE-2020-7788): An attacker can manipulate an INI file to modify the prototype of an object, leading to potential code execution or denial of service.
-
Use-after-free in the TLS implementation in nodejs (CVE-2020-8265): This vulnerability allows an attacker to exploit a memory corruption issue in the TLS implementation, potentially leading to remote code execution.
-
HTTP request smuggling via two copies of a header field in an HTTP request in nodejs (CVE-2020-8287): An attacker can manipulate an HTTP request to smuggle additional headers, potentially bypassing security measures or causing unexpected behavior.
How To Fix
Minimum fixed version
2.0.3-1.module_el8.4.0+2521+c668cc9f
This is the first release that contains the fix.
sudo dnf update nodejs-nodemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the nodejs package version 12.20.1 and the nodejs-nodemon package version 2.0.3 contain security updates to address multiple vulnerabilities. It is recommended to update these packages to ensure the security of your Node.js applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to potential code execution or denial of service.
A regular expression denial of service (ReDoS) attack is a type of denial of service attack that exploits the exponential time complexity of certain regular expressions, causing the application to consume excessive CPU resources and become unresponsive.
You can update the nodejs package using the package manager for your operating system. For example, on Linux, you can use the package manager's update command to install the latest version of the package.
You can find more information about these vulnerabilities, including their impact, CVSS scores, acknowledgments, and related information, on the respective CVE pages listed in the References section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
