Moderate: nodejs:14 security and bug fix update
Summary
ALSA-2021:0551: Moderate: nodejs:14 security and bug fix update. Affects nodejs-nodemon versions < 2.0.3-1.module_el8.4.0+2521+c668cc9f. Fixed in 2.0.3-1.module_el8.4.0+2521+c668cc9f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications. The nodejs package is a core component of the Node.js platform.
Vulnerability Detail
The nodejs package has been upgraded to version 14.15.4 to address several security vulnerabilities:
-
CVE-2020-7754: Improper input validation in the nodejs-npm-user-validate package could lead to ReDoS (Regular Expression Denial of Service) attacks.
-
CVE-2020-7774: The nodejs-y18n package is vulnerable to prototype pollution, which could allow an attacker to modify the behavior of JavaScript objects.
-
CVE-2020-7788: The nodejs-ini package is vulnerable to prototype pollution via a malicious INI file, potentially leading to arbitrary code execution.
-
CVE-2020-8265: The nodejs package is affected by a use-after-free vulnerability in the TLS (Transport Layer Security) implementation, which could result in a crash or potential remote code execution.
-
CVE-2020-8277: The c-ares package is vulnerable to a denial-of-service (DoS) attack due to insufficient validation of naddrttls in the ares_parse_{a,aaaa}_reply() functions.
-
CVE-2020-15366: The nodejs-ajv package is vulnerable to prototype pollution via a crafted JSON schema in the ajv.validate function, potentially leading to arbitrary code execution.
-
CVE-2020-8287: The nodejs package is vulnerable to HTTP request smuggling attacks when two copies of a header field are present in an HTTP request.
How To Fix
Minimum fixed version
2.0.3-1.module_el8.4.0+2521+c668cc9f
This is the first release that contains the fix.
sudo dnf update nodejs-nodemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating the nodejs package to version 14.15.4 is crucial to address these security vulnerabilities. It is recommended to perform the update as soon as possible to ensure the security and stability of your Node.js applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
A use-after-free vulnerability occurs when a program continues to use a memory address after it has been freed, potentially leading to crashes or remote code execution.
Prototype pollution is a vulnerability that allows an attacker to modify the behavior of JavaScript objects by injecting properties into their prototype.
A denial-of-service attack is an attempt to make a computer or network resource unavailable to its intended users, typically by overwhelming it with a flood of incoming requests.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
