The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-200:01 advisory.

    * nodejs-brace-expansion: Regular expression denial of service (CVE-2017-18077)
      * nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js (CVE-2017-18869)
      * nodejs-sshpk: ReDoS when parsing crafted invalid public keys in lib/formats/ssh.js (CVE-2018-3737)
      * nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties     (CVE-2018-3750)
      * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)
      * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)
      * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into
    modifying the prototype of Object when the attacker can control part of the structure passed to this
    function. This can let an attacker add or modify existing properties that will exist on all objects.
    (CVE-2018-3750)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into     modifying the prototype of Object when the attacker can control part of the structure passed to this     function. This can let an attacker add or modify existing properties that will exist on all objects.
    (CVE-2018-3750)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:0549 advisory.

  - The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into     modifying the prototype of Object when the attacker can control part of the structure passed to this     function. This can let an attacker add or modify existing properties that will exist on all objects.
    (CVE-2018-3750)

  - mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function     mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor     payload. (CVE-2019-10746)

  - set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could     be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype     and _proto_ payloads. (CVE-2019-10747)

  - This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took     exponentially longer to process long input strings beginning with @ characters. (CVE-2020-7754)

  - This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application     that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited     further depending on the context. (CVE-2020-7788)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its     TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls     node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method     does not return an error, this object is passed back to the caller as part of a StreamWriteResult     structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other     exploits. (CVE-2020-8265)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP     request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first     header field and ignores the second. This can lead to HTTP Request Smuggling. (CVE-2020-8287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2625 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs8-nodejs (8.17.0).
    (BZ#1829414)

    Security Fix(es):

    * nodejs-brace-expansion: Regular expression denial of service (CVE-2017-18077)

    * nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js (CVE-2017-18869)

    * nodejs-sshpk: ReDoS when parsing crafted invalid public keys in lib/formats/ssh.js (CVE-2018-3737)

    * nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-3750)

    * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

    * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

    * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0485 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.20.1), rh-     nodejs12-nodejs-nodemon (2.0.3).

    Security Fix(es):

    * nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

    * nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

    * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

    * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

    * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

    * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0549 advisory.

  - nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-3750)

  - nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

  - nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

  - nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

  - nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  - nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  - nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0549 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon     (2.0.3).

    Security Fix(es):

    * nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

    * nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

    * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

    * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

    * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

    * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2018-3750

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
294570	MiracleLinux 7 : rh-nodejs8-nodejs-8.17.0-2.el7 (AXSA:2020-200:01)	Nessus	Miracle Linux Local Security Checks	Local	critical
422823	SCA: security update for deep-extend (GHSA-hr2v-3952-633q)	Tenable Cloud Security	SCA Checks	Local	critical
422823	SCA: security update for deep-extend (GHSA-hr2v-3952-633q)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
222671	Linux Distros Unpatched Vulnerability : CVE-2018-3750	Nessus	Misc.	Local	critical
184892	Rocky Linux 8 : nodejs:12 (RLSA-2021:0549)	Nessus	Rocky Linux Local Security Checks	Local	critical
170350	RHEL 7 : rh-nodejs8-nodejs (RHSA-2020:2625)	Nessus	Red Hat Local Security Checks	Local	critical
165165	RHEL 7 : rh-nodejs12-nodejs (RHSA-2021:0485)	Nessus	Red Hat Local Security Checks	Local	critical
146539	CentOS 8 : nodejs:12 (CESA-2021:0549)	Nessus	CentOS Local Security Checks	Local	critical
146536	RHEL 8 : nodejs:12 (RHSA-2021:0549)	Nessus	Red Hat Local Security Checks	Local	critical
120476	Fedora 28 : nodejs-deep-extend (2018-636f73964f)	Nessus	Fedora Local Security Checks	Local	critical

Detections

Analytics

CVE-2018-3750

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical