Most recent entries from all

ALSA-2020:4272 — Moderate: nodejs:12 security and bug fix update

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

Security Fix(es):

* nodejs-dot-prop: prototype pollution (CVE-2020-8116)

* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

* npm: Sensitive information exposure through logs (CVE-2020-15095)

* libuv: buffer overflow in realpath (CVE-2020-8252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* The nodejs:12/development module is not installable (BZ#1883966)

Withdrawn: BELL-CVE-2020-8252 — CVE-2020-8252 does not affect BellSoft software

Withdrawn by the publisher.

BIT-node-2020-8252

Affected: Bitnami: node

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

certfr-2020-avi-680 — De multiples vulnérabilités ont été découvertes dans Stormshield Network Security. Elles permettent à un attaquant de p…

certfr-2020-avi-680

Withdrawn: CLEANSTART-2026-BD71263 — Security fixes for CVE-2017-14919, CVE-2017-15896, CVE-2018-0734, CVE-2018-0735, CVE-2018-1000168, CVE-2018-12121, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: nodejs

Multiple security vulnerabilities affect the nodejs package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-236158

fkie_cve-2020-8252

GHSA-c5r6-cm8r-wgh9

gsd-2020-8252

ICSA-22-111-03 — Hitachi Energy MicroSCADA Pro/X SYS600

The Raccoon attack exploits a flaw in the TLS specification that can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. This would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note this vulnerability only impacts DH ciphersuites and not ECDH ciphersuites. This vulnerability affects OpenSSL 1.0.2, which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).CVE-2020-1968 has been assigned to this vulnerability. A CVSS v3 base score of 3.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP request smuggling.CVE-2020-8265 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fiel…

openSUSE-SU-2020:1616-1 — Security update for nodejs12

Security update for nodejs12

RHSA-2020:4903 — Red Hat Security Advisory: nodejs:12 security and bug fix update

nodejs-dot-prop: prototype pollution nodejs: HTTP request smuggling due to CR-to-Hyphen conversion libuv: buffer overflow in realpath npm: sensitive information exposure through logs

SUSE-SU-2020:2812-1 — Security update for nodejs12

Security update for nodejs12

UBUNTU-CVE-2020-8252

Affected: Ubuntu:20.04:LTS: libuv1

WID-SEC-W-2023-0486 — Node.js: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.