An update of the cmake package has been released.

This update for nodejs10 fixes the following issues :

nodejs10 was updated to version 10.21.0

CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).

CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).

CVE-2020-10531: Fixed an integer overflow in UnicodeString:doAppend() (bsc#1166844).

npm was updated to 6.14.3

CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2852 advisory.

    - Fix CVE-2020-10531

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs8 fixes the following issues :

CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).

CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).

CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916)

CVE-2020-15095: Fixed information leak through log files (bsc#1173937).

Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686).

Add Require for nodejs8 when intalling npm8 (bsc#1172728)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:2852 advisory.

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

  - minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a     constructor or __proto__ payload. (CVE-2020-7598)

  - TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
    (CVE-2020-8172)

  - napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and <     14.4.0. (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:2848 advisory.

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

  - minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a     constructor or __proto__ payload. (CVE-2020-7598)

  - napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and <     14.4.0. (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nghttp2 installed on the remote host is prior to 1.33.0-1.1.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1404 advisory.

    In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the nghttp2 package has been released.

An update of the nodejs package has been released.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:2755 advisory.

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for nghttp2 fixes the following issues :

  - CVE-2020-11080: HTTP/2 Large Settings Frame DoS     (bsc#1181358)

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2524 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
204458	Photon OS 5.0: Cmake PHSA-2023-5.0-0035	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
137602	SUSE SLES12 Security Update : nodejs10 (SUSE-SU-2020:1575-1)	Nessus	SuSE Local Security Checks	6/18/2020	3/6/2024	high
138482	Oracle Linux 8 : nodejs:12 (ELSA-2020-2852)	Nessus	Oracle Linux Local Security Checks	8/13/2020	11/1/2024	high
143610	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2020:2800-1)	Nessus	SuSE Local Security Checks	12/9/2020	2/6/2024	high
184832	Rocky Linux 8 : nodejs:12 (RLSA-2020:2852)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	high
184927	Rocky Linux 8 : nodejs:10 (RLSA-2020:2848)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	high
139085	Amazon Linux AMI : nghttp2 (ALAS-2020-1404)	Nessus	Amazon Linux Local Security Checks	7/30/2020	12/11/2024	high
204588	Photon OS 4.0: Cmake PHSA-2023-4.0-0420	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
137718	Photon OS 2.0: Nghttp2 PHSA-2020-2.0-0254	Nessus	PhotonOS Local Security Checks	6/22/2020	7/23/2024	high
137876	Photon OS 1.0: Nghttp2 PHSA-2020-1.0-0304	Nessus	PhotonOS Local Security Checks	6/29/2020	12/5/2022	high
203988	Photon OS 3.0: Nodejs PHSA-2023-3.0-0606	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	high
157635	AlmaLinux 8 : nghttp2 (ALSA-2020:2755)	Nessus	Alma Linux Local Security Checks	2/9/2022	12/5/2022	high
148159	openSUSE Security Update : nghttp2 (openSUSE-2021-468)	Nessus	SuSE Local Security Checks	3/26/2021	1/8/2024	high
137335	RHEL 8 : Red Hat OpenShift Service Mesh 1.0 servicemesh-proxy (RHSA-2020:2524)	Nessus	Red Hat Local Security Checks	6/11/2020	11/7/2024	high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

high

critical

high

high

high

high

high

high