This update for nodejs8 fixes the following issue :

CVE-2020-8287: Fixed an HTTP request smuggling vulnerability (bsc#1180554).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs8 fixes the following issue :

  - CVE-2020-8287: Fixed an HTTP request smuggling     vulnerability (bsc#1180554).

This update was imported from the SUSE:SLE-15:Update update project.

The version of Node.js installed on the remote host is 10.x prior to 10.23.1, 12.x prior to 12.20.1, 14.x prior to 14.15.4, or 15.x prior to 15.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the january-2021-security-releases advisory.

  - The X.509 GeneralName type is a generic type for representing different types of names. One of those name     types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different     instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both     GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a     possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1)     Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in     an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp     authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an     attacker can control both items being compared then that attacker could trigger a crash. For example if     the attacker can trick a client or server into checking a malicious certificate against a malicious CRL     then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a     certificate. This checking happens prior to the signatures on the certificate and CRL being verified.
    OpenSSL's s_server, s_client and verify tools have support for the -crl_download option which implements     automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an     unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of     EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will     accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue.
    Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected     1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). (CVE-2020-1971)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP     request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first     header field and ignores the second. This can lead to HTTP Request Smuggling. (CVE-2020-8287)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS     implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite     with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an     error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be     exploited to corrupt memory leading to a Denial of Service or potentially other exploits. (CVE-2020-8265)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0549 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon     (2.0.3).

    Security Fix(es):

    * nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

    * nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

    * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

    * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

    * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

    * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1451:01 advisory.

    * nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)
      * nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)
      * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)
      * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
      * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
      * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0521 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.23.1).

    Security Fix(es):

    * libuv: buffer overflow in realpath (CVE-2020-8252)

    * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

    * nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

    * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)

    * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

    * npm: sensitive information exposure through logs (CVE-2020-15095)

    * nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

    * nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

    * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in Node.js, which could result in denial of service and potentially the execution of arbitrary code or HTTP request smuggling.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-d5b2c18fe6 advisory.

  - Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
    The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally     Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and     keep the allocation alive until the session dies. This can consume excess memory. (CVE-2019-9516)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its     TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls     node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method     does not return an error, this object is passed back to the caller as part of a StreamWriteResult     structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other     exploits. (CVE-2020-8265)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP     request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first     header field and ignores the second. This can lead to HTTP Request Smuggling. (CVE-2020-8287)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_0551 advisory.

    * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

    * nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

    * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

    * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

    * c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)

    * nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

    * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0549 advisory.

    nodejs     [1:12.20.1-1]
    - Security rebase for January security release
    - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
    - Resolves: RHBZ#1916460, RHBZ#1914786
    - Resolves: RHBZ#1914784, RHBZ#1916396

    nodejs-nodemon     [2.0.3-1]
    - Resolves: RHBZ#1921841, RHBZ#1921843, RHBZ#1921842
    - Rebase to 2.0.3

    nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
145487	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2021:0224-1)	Nessus	SuSE Local Security Checks	1/27/2021	1/26/2024	medium
145762	openSUSE Security Update : nodejs8 (openSUSE-2021-195)	Nessus	SuSE Local Security Checks	2/1/2021	1/25/2024	medium
144949	Node.js 10.x < 10.23.1 / 12.x < 12.20.1 / 14.x < 14.15.4 / 15.x < 15.5.1 Multiple Vulnerabilities	Nessus	Misc.	1/14/2021	10/9/2026	high
146536	RHEL 8 : nodejs:12 (RHSA-2021:0549)	Nessus	Red Hat Local Security Checks	2/16/2021	3/13/2025	critical
293983	MiracleLinux 7 : rh-nodejs12-nodejs-nodemon-2.0.3-1.el7, rh-nodejs12-nodejs-12.20.1-1.el7 (AXSA:2021-1451:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	critical
165111	RHEL 7 : rh-nodejs10-nodejs (RHSA-2021:0521)	Nessus	Red Hat Local Security Checks	9/15/2022	11/7/2024	critical
144824	Debian DSA-4826-1 : nodejs - security update	Nessus	Debian Local Security Checks	1/11/2021	1/30/2024	high
145022	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2021:0121-1)	Nessus	SuSE Local Security Checks	1/15/2021	1/30/2024	medium
145150	Fedora 32 : 1:nodejs (2021-d5b2c18fe6)	Nessus	Fedora Local Security Checks	1/20/2021	1/29/2024	high
359423	Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2021_0551)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/2/2026	critical
146636	Oracle Linux 8 : nodejs:12 (ELSA-2021-0549)	Nessus	Oracle Linux Local Security Checks	2/19/2021	11/1/2024	critical

Detections

Analytics

Plugins Search

medium

medium

high

critical

critical

critical

high

medium

high

critical

critical