Most recent entries from all

ALSA-2021:5171 — Moderate: nodejs:16 security, bug fix, and enhancement update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)

Security Fix(es):

* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

* normalize-url: ReDoS for data URLs (CVE-2021-33502)

* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BIT-gulp-2020-28469 — Regular Expression Denial of Service (ReDoS)

Affected: Bitnami: gulp

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

certfr-2021-avi-791 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2021-avi-791

EUVD-2026-168452

fkie_cve-2020-28469

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

GHSA-ww39-953v-wcq6 — glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex

Affected: npm: glob-parent

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

gsd-2020-28469

RHSA-2021:1499 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.3 security and bug fix update

nodejs-glob-parent: Regular expression denial of service nodejs-underscore: Arbitrary code execution via the template function nodejs-is-svg: ReDoS via malicious string nodejs-netmask: improper input validation of octal input data nodejs-netmask: incorrectly parses an IP address that has octal integer with invalid character

RHSA-2021:5171 — Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

nodejs-ini: Prototype pollution via malicious INI file nodejs-glob-parent: Regular expression denial of service nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes nodejs-json-schema: Prototype pollution vulnerability llhttp: HTTP Request Smuggling due to spaces in headers llhttp: HTTP Request Smuggling when parsing the body of chunked requests nodejs-normalize-url: ReDoS for data URLs

WID-SEC-W-2022-1354 — Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.