set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:0549 advisory.

  - The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into     modifying the prototype of Object when the attacker can control part of the structure passed to this     function. This can let an attacker add or modify existing properties that will exist on all objects.
    (CVE-2018-3750)

  - mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function     mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor     payload. (CVE-2019-10746)

  - set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could     be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype     and _proto_ payloads. (CVE-2019-10747)

  - This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took     exponentially longer to process long input strings beginning with @ characters. (CVE-2020-7754)

  - This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application     that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited     further depending on the context. (CVE-2020-7788)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its     TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls     node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method     does not return an error, this object is passed back to the caller as part of a StreamWriteResult     structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other     exploits. (CVE-2020-8265)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP     request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first     header field and ignores the second. This can lead to HTTP Request Smuggling. (CVE-2020-8287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0485 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.20.1), rh-     nodejs12-nodejs-nodemon (2.0.3).

    Security Fix(es):

    * nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

    * nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

    * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

    * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

    * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

    * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0549 advisory.

  - nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-3750)

  - nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

  - nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

  - nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

  - nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  - nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  - nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0549 advisory.

    nodejs     [1:12.20.1-1]
    - Security rebase for January security release
    - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
    - Resolves: RHBZ#1916460, RHBZ#1914786
    - Resolves: RHBZ#1914784, RHBZ#1916396

    nodejs-nodemon     [2.0.3-1]
    - Resolves: RHBZ#1921841, RHBZ#1921843, RHBZ#1921842
    - Rebase to 2.0.3

    nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0549 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon     (2.0.3).

    Security Fix(es):

    * nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

    * nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

    * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

    * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

    * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

    * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to upstream 2.0.1 release for CVE-2019-10747

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184892	Rocky Linux 8 : nodejs:12 (RLSA-2021:0549)	Nessus	Rocky Linux Local Security Checks	critical
165165	RHEL 7 : rh-nodejs12-nodejs (RHSA-2021:0485)	Nessus	Red Hat Local Security Checks	critical
146539	CentOS 8 : nodejs:12 (CESA-2021:0549)	Nessus	CentOS Local Security Checks	critical
146636	Oracle Linux 8 : nodejs:12 (ELSA-2021-0549)	Nessus	Oracle Linux Local Security Checks	critical
146536	RHEL 8 : nodejs:12 (RHSA-2021:0549)	Nessus	Red Hat Local Security Checks	critical
133572	Fedora 31 : nodejs-set-value (2020-582515fa8a)	Nessus	Fedora Local Security Checks	critical
133564	Fedora 30 : nodejs-set-value (2020-1f1c94907b)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2019-10747

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical