Most recent entries from all

ALSA-2020:2848 — Important: nodejs:10 security update

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

Security Fix(es):

* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)

* nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-02868

certfr-2022-avi-767 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2022-avi-767

cnvd-2020-19556

EUVD-2026-38033

fkie_cve-2020-7598

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

GHSA-vh95-rmgr-6w4m — Prototype Pollution in minimist

Affected: npm: minimist

Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to `minimist`.

## Recommendation

Upgrade to versions 0.2.1, 1.2.3 or later.

gsd-2020-7598

OESA-2021-1397 — nodejs-minimist security update

Affected: openEuler:20.03-LTS-SP1: nodejs-minimist, openEuler:20.03-LTS-SP2: nodejs-minimist

This module is the guts of nodejs-optimist's argument parser without all the fanciful decoration. Security Fix(es): minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.(CVE-2020-7598)

openSUSE-SU-2020:0802-1 — Security update for nodejs8

Security update for nodejs8

RHSA-2020:2362 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update

nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method grafana: information disclosure through world-readable grafana configuration files

SUSE-SU-2020:1568-1 — Security update for nodejs10

Security update for nodejs10

UBUNTU-CVE-2020-7598

Affected: Ubuntu:16.04:LTS: node-minimist, Ubuntu:18.04:LTS: node-minimist

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.