-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Moderate: nodejs:12 security update
Advisory ID:       RHSA-2021:0549-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:0549
Issue date:        2021-02-16
CVE Names:         CVE-2019-10746 CVE-2019-10747 CVE-2020-7754 
                   CVE-2020-7788 CVE-2020-8265 CVE-2020-8287 
====================================================================
1. Summary:

An update for the nodejs:12 module is now available for Red Hat Enterprise
Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language. 

The following packages have been upgraded to a later upstream version:
nodejs (12.20.1), nodejs-nodemon (2.0.3).

Security Fix(es):

* nodejs-mixin-deep: prototype pollution in function mixin-deep
(CVE-2019-10746)

* nodejs-set-value: prototype pollution in function set-value
(CVE-2019-10747)

* nodejs-npm-user-validate: improper input validation when validating user
emails leads to ReDoS (CVE-2020-7754)

* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

* nodejs: HTTP request smuggling via two copies of a header field in an
http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1795475 - CVE-2019-10746 nodejs-mixin-deep: prototype pollution in function mixin-deep
1795479 - CVE-2019-10747 nodejs-set-value: prototype pollution in function set-value
1892430 - CVE-2020-7754 nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS
1907444 - CVE-2020-7788 nodejs-ini: prototype pollution via malicious INI file
1912854 - CVE-2020-8265 nodejs: use-after-free in the TLS implementation
1912863 - CVE-2020-8287 nodejs: HTTP request smuggling via two copies of a header field in an http request

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
nodejs-12.20.1-1.module+el8.3.0+9503+19cb079c.src.rpm
nodejs-nodemon-2.0.3-1.module+el8.3.0+9715+1718613f.src.rpm
nodejs-packaging-17-3.module+el8.1.0+3369+37ae6a45.src.rpm

aarch64:
nodejs-12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm
nodejs-debuginfo-12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm
nodejs-debugsource-12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm
nodejs-devel-12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm
nodejs-full-i18n-12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm
npm-6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c.aarch64.rpm

noarch:
nodejs-docs-12.20.1-1.module+el8.3.0+9503+19cb079c.noarch.rpm
nodejs-nodemon-2.0.3-1.module+el8.3.0+9715+1718613f.noarch.rpm
nodejs-packaging-17-3.module+el8.1.0+3369+37ae6a45.noarch.rpm

ppc64le:
nodejs-12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm
nodejs-debuginfo-12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm
nodejs-debugsource-12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm
nodejs-devel-12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm
nodejs-full-i18n-12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm
npm-6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c.ppc64le.rpm

s390x:
nodejs-12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm
nodejs-debuginfo-12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm
nodejs-debugsource-12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm
nodejs-devel-12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm
nodejs-full-i18n-12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm
npm-6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c.s390x.rpm

x86_64:
nodejs-12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm
nodejs-debuginfo-12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm
nodejs-debugsource-12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm
nodejs-devel-12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm
nodejs-full-i18n-12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm
npm-6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-10746
https://access.redhat.com/security/cve/CVE-2019-10747
https://access.redhat.com/security/cve/CVE-2020-7754
https://access.redhat.com/security/cve/CVE-2020-7788
https://access.redhat.com/security/cve/CVE-2020-8265
https://access.redhat.com/security/cve/CVE-2020-8287
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYCvbd9zjgjWX9erEAQjDNxAAgGr9ACtVc9QgUmYjV2HXYcCnjs7IaC7t
DCasMPfhgLJzGq5JvQyyh4PGDOkQOKYj4nPHLKDmmjnMltXW2c3GE9/So1C4VkIn
8AnLbehRB90jBn+PjKKmkx2NR+7bxQJ/qOU2H2d2MFokq6ivEU0J7zIV1Si9MVuE
TuXJeRtZiIkcGeIR08Iple5J512bgsuO/Kt0FGjASpQn76lS9yiH7Cl9jdvawaYy
vZ9BpGeYsZaxrQl3Qo+R+vIMuzMfkIzsr0fjK+Tvrf7DdZqKFNfZmYXXdSND08h2
Im3s5RvX+zWEQu3qDxDwP9d+d7JeIphAaaabgRmc8tVGyGV88jrgW3UAeEOCFXVc
AGYPpT1tErNVcMCkMfskL4JUEkFI1QqBisICOAw0+APaVe3Rd5U1/ovgPx+0tZ1o
7tWAZhSH5VZa16WIl4HjbJmBelqHWE/BoetMxPVYURiLVHhb+shY5Y6GESd7N/ee
wUErIfEL7Wtx2xePZp2n+N7jk5z7yndYWuk113GQ6Q15Qin1KMP7wDq4x43KUq6R
uIqo0UQ8pHAs6s40FcucrnyAHCaFaNAZ8SaSzSDaYQGw00Lhy8ciJJvXl59nGvwI
hq9COD8VoDkDDkyq/0j7ExtTYPtmRiTa7gxHgdMY5WdZHO94EuyAmwxJ0JXSI+KH
OXpbVTkGsPs=nqeM
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2021-0549:01 Moderate: nodejs:12 security update

An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).
Security Fix(es):
* nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)
* nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)
* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Summary

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2019-10746 https://access.redhat.com/security/cve/CVE-2019-10747 https://access.redhat.com/security/cve/CVE-2020-7754 https://access.redhat.com/security/cve/CVE-2020-7788 https://access.redhat.com/security/cve/CVE-2020-8265 https://access.redhat.com/security/cve/CVE-2020-8287 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: nodejs-12.20.1-1.module+el8.3.0+9503+19cb079c.src.rpm nodejs-nodemon-2.0.3-1.module+el8.3.0+9715+1718613f.src.rpm nodejs-packaging-17-3.module+el8.1.0+3369+37ae6a45.src.rpm
aarch64: nodejs-12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm nodejs-debuginfo-12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm nodejs-debugsource-12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm nodejs-devel-12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm nodejs-full-i18n-12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm npm-6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c.aarch64.rpm
noarch: nodejs-docs-12.20.1-1.module+el8.3.0+9503+19cb079c.noarch.rpm nodejs-nodemon-2.0.3-1.module+el8.3.0+9715+1718613f.noarch.rpm nodejs-packaging-17-3.module+el8.1.0+3369+37ae6a45.noarch.rpm
ppc64le: nodejs-12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm nodejs-debuginfo-12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm nodejs-debugsource-12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm nodejs-devel-12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm nodejs-full-i18n-12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm npm-6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c.ppc64le.rpm
s390x: nodejs-12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm nodejs-debuginfo-12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm nodejs-debugsource-12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm nodejs-devel-12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm nodejs-full-i18n-12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm npm-6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c.s390x.rpm
x86_64: nodejs-12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm nodejs-debuginfo-12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm nodejs-debugsource-12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm nodejs-devel-12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm nodejs-full-i18n-12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm npm-6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity

Advisory ID: RHSA-2021:0549-01

Product: Red Hat Enterprise Linux

Advisory URL: https://access.redhat.com/errata/RHSA-2021:0549

Issued Date: : 2021-02-16

CVE Names: CVE-2019-10746 CVE-2019-10747 CVE-2020-7754 CVE-2020-7788 CVE-2020-8265 CVE-2020-8287

Topic

An update for the nodejs:12 module is now available for Red Hat EnterpriseLinux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.