Most recent entries from all

ALSA-2020:4272 — Moderate: nodejs:12 security and bug fix update

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

Security Fix(es):

* nodejs-dot-prop: prototype pollution (CVE-2020-8116)

* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

* npm: Sensitive information exposure through logs (CVE-2020-15095)

* libuv: buffer overflow in realpath (CVE-2020-8252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* The nodejs:12/development module is not installable (BZ#1883966)

bdu:2020-05657

Withdrawn: BELL-CVE-2020-8201 — CVE-2020-8201 does not affect BellSoft software

Withdrawn by the publisher.

BIT-node-2020-8201

Affected: Bitnami: node

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

certfr-2020-avi-680 — De multiples vulnérabilités ont été découvertes dans Stormshield Network Security. Elles permettent à un attaquant de p…

certfr-2020-avi-680

CLEANSTART-2026-AZ08951 — Security fix for CVE-2020-8201 applied in: nodejs 12.18.4-r0

Affected: CleanStart: nodejs

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-236156

fkie_cve-2020-8201

GHSA-7mcp-gwc2-4c6m

gsd-2020-8201

ICSA-22-111-03 — Hitachi Energy MicroSCADA Pro/X SYS600

The Raccoon attack exploits a flaw in the TLS specification that can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. This would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note this vulnerability only impacts DH ciphersuites and not ECDH ciphersuites. This vulnerability affects OpenSSL 1.0.2, which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).CVE-2020-1968 has been assigned to this vulnerability. A CVSS v3 base score of 3.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP request smuggling.CVE-2020-8265 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fiel…

openSUSE-SU-2020:1616-1 — Security update for nodejs12

Security update for nodejs12

RHSA-2020:4903 — Red Hat Security Advisory: nodejs:12 security and bug fix update

nodejs-dot-prop: prototype pollution nodejs: HTTP request smuggling due to CR-to-Hyphen conversion libuv: buffer overflow in realpath npm: sensitive information exposure through logs

SUSE-SU-2020:2812-1 — Security update for nodejs12

Security update for nodejs12

Withdrawn: UBUNTU-CVE-2020-8201

Withdrawn by the publisher.

Affected: Ubuntu:22.04:LTS: nodejs

WID-SEC-W-2023-0486 — Node.js: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.