ALSA-2020:0579

Source

https://errata.almalinux.org/8/ALSA-2020-0579.html

Import Source

https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:0579.json

Related

• CVE-2019-15604
• CVE-2019-15605
• CVE-2019-15606
• CVE-2019-16775
• CVE-2019-16776
• CVE-2019-16777

Published

2020-02-25T07:57:02Z

Modified

2020-02-25T07:57:02Z

Summary

Important: nodejs:10 security update

Details

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

• nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

• nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

• nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

• npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

• npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

• npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

• https://errata.almalinux.org/8/ALSA-2020-0579.html
• https://vulners.com/cve/CVE-2019-15604
• https://vulners.com/cve/CVE-2019-15605
• https://vulners.com/cve/CVE-2019-15606
• https://vulners.com/cve/CVE-2019-16775
• https://vulners.com/cve/CVE-2019-16776
• https://vulners.com/cve/CVE-2019-16777