RHSA-2020:0579: Important: nodejs:10 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.The following packages have been upgraded to a later upstream version: nodejs (10.19.0).Security Fix(es): nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605) nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604) nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606) npm: Symlink reference outside of nodemodules folder through the bin field upon installation (CVE-2019-16775) npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776) npm: Global nodemodules Binary Overwrite (CVE-2019-16777) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 10.19.0-1.module+el8.1.0+5726+6ed65f8c - Upgrade
Upgrade
redhat/nodejs-nodemonto a version that resolves this vulnerability.Fixed in 1.18.3-1.module+el8+2632+6c5111ed - Upgrade
Upgrade
redhat/nodejs-packagingto a version that resolves this vulnerability.Fixed in 17-3.module+el8+2873+aa7dfd9a - Upgrade
Upgrade
redhat/nodejs-docsto a version that resolves this vulnerability.Fixed in 10.19.0-1.module+el8.1.0+5726+6ed65f8c - Upgrade
Upgrade
redhat/nodejs-debuginfoto a version that resolves this vulnerability.Fixed in 10.19.0-1.module+el8.1.0+5726+6ed65f8c - Upgrade
Upgrade
redhat/nodejs-debugsourceto a version that resolves this vulnerability.Fixed in 10.19.0-1.module+el8.1.0+5726+6ed65f8c - Upgrade
Upgrade
redhat/nodejs-develto a version that resolves this vulnerability.Fixed in 10.19.0-1.module+el8.1.0+5726+6ed65f8c - Upgrade
Upgrade
redhat/nodejs-devel-debuginfoto a version that resolves this vulnerability.Fixed in 10.19.0-1.module+el8.1.0+5726+6ed65f8c - Upgrade
Upgrade
redhat/npmto a version that resolves this vulnerability.Fixed in 6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 10.19.0-1.module+el8.1.0+5726+6ed65f8c.aa - Upgrade
Upgrade
redhat/nodejs-debuginfoto a version that resolves this vulnerability.Fixed in 10.19.0-1.module+el8.1.0+5726+6ed65f8c.aa - Upgrade
Upgrade
redhat/nodejs-debugsourceto a version that resolves this vulnerability.Fixed in 10.19.0-1.module+el8.1.0+5726+6ed65f8c.aa - Upgrade
Upgrade
redhat/nodejs-develto a version that resolves this vulnerability.Fixed in 10.19.0-1.module+el8.1.0+5726+6ed65f8c.aa - Upgrade
Upgrade
redhat/npmto a version that resolves this vulnerability.Fixed in 6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c.aa - Upgrade
Upgrade
nodejsto a version that resolves this vulnerability.Fixed in 10.19.0Patch CVE-2019-15605
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:0579?
The severity of RHSA-2020:0579 is categorized as important due to the identified HTTP request smuggling vulnerabilities.
How do I fix RHSA-2020:0579?
To fix RHSA-2020:0579, upgrade to the patched version of nodejs 10.19.0-1.module+el8.1.0+5726+6ed65f8c.
Which packages are affected by RHSA-2020:0579?
The affected packages under RHSA-2020:0579 include nodejs, nodejs-nodemon, nodejs-packaging, and several others associated with nodejs.
What vulnerabilities are addressed in RHSA-2020:0579?
RHSA-2020:0579 addresses vulnerabilities related to HTTP request smuggling.
Is there a risk of exploitation for RHSA-2020:0579?
Yes, the vulnerabilities in RHSA-2020:0579 pose a risk of exploitation if the recommended security updates are not applied.