The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:0549 advisory.

  - The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into     modifying the prototype of Object when the attacker can control part of the structure passed to this     function. This can let an attacker add or modify existing properties that will exist on all objects.
    (CVE-2018-3750)

  - mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function     mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor     payload. (CVE-2019-10746)

  - set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could     be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype     and _proto_ payloads. (CVE-2019-10747)

  - This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took     exponentially longer to process long input strings beginning with @ characters. (CVE-2020-7754)

  - This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application     that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited     further depending on the context. (CVE-2020-7788)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its     TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls     node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method     does not return an error, this object is passed back to the caller as part of a StreamWriteResult     structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other     exploits. (CVE-2020-8265)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP     request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first     header field and ignores the second. This can lead to HTTP Request Smuggling. (CVE-2020-8287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2018-3750

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0549 advisory.

  - nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-3750)

  - nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

  - nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

  - nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

  - nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  - nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  - nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2625 advisory.

  - nodejs-brace-expansion: Regular expression denial of service (CVE-2017-18077)

  - nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js (CVE-2017-18869)

  - nodejs-sshpk: ReDoS when parsing crafted invalid public keys in lib/formats/ssh.js (CVE-2018-3737)

  - nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-3750)

  - npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

  - npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

  - npm: Global node_modules Binary Overwrite (CVE-2019-16777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0549 advisory.

  - nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-3750)

  - nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

  - nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

  - nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

  - nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  - nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  - nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0485 advisory.

  - nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-3750)

  - nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

  - nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

  - nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

  - nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  - nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  - nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
184892	Rocky Linux 8 : nodejs:12 (RLSA-2021:0549)	Nessus	Rocky Linux Local Security Checks	11/7/2023	12/22/2023	critical
120476	Fedora 28 : nodejs-deep-extend (2018-636f73964f)	Nessus	Fedora Local Security Checks	1/3/2019	1/6/2021	critical
146536	RHEL 8 : nodejs:12 (RHSA-2021:0549)	Nessus	Red Hat Local Security Checks	2/16/2021	4/28/2024	critical
170350	RHEL 7 : rh-nodejs8-nodejs (RHSA-2020:2625)	Nessus	Red Hat Local Security Checks	1/23/2023	4/28/2024	critical
146539	CentOS 8 : nodejs:12 (CESA-2021:0549)	Nessus	CentOS Local Security Checks	3/11/2021	1/10/2024	critical
165165	RHEL 7 : rh-nodejs12-nodejs (RHSA-2021:0485)	Nessus	Red Hat Local Security Checks	9/15/2022	4/28/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical