This update for nodejs10 to version 10.18.0 fixes the following issues :

Security issues fixed :

CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing an arbitrary path overwrite and access via 'bin' field (bsc#1159352).

Added support for chacha20-poly1305 for Authenticated encryption (AEAD).

Non-security issues fixed :

Fixed wrong path in gypi files (bsc#1159812).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 12.14.1

Add new subpackage `nodejs-full-i18n` to provide non-English locale and Unicode support.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs12 fixes the following issues :

nodejs12 was updated to version 12.15.0.

Security issues fixed :

CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).

CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).

CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).

CVE-2019-16775: Fixed an arbitrary file write vulnerability (bsc#1159352).

CVE-2019-16776: Fixed an arbitrary file write vulnerability (bsc#1159352).

CVE-2019-16777: Fixed an arbitrary file write vulnerability (bsc#1159352).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-4480:02 advisory.

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)
      * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)
      * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)
      * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)
      * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)
      * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0579 advisory.

  - nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  - nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  - nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

  - npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

  - npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

  - npm: Global node_modules Binary Overwrite (CVE-2019-16777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs8 to version 8.17.0 fixes the following issues :

Security issues fixed :

  - CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated     npm to 6.13.4, fixing an arbitrary path overwrite and     access via 'bin' field (bsc#1159352).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0573 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

    Security Fix(es):

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

    * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)

    * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

    * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

    * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

    * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-48 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly write arbitrary files, cause a Denial       of Service condition or can conduct HTTP request splitting attacks.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0602 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.16.1).

    Security Fix(es):

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

    * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)

    * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

    * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

    * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

    * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-4479:01 advisory.

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)
      * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)
      * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)
      * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)
      * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)
      * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-200:01 advisory.

    * nodejs-brace-expansion: Regular expression denial of service (CVE-2017-18077)
      * nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js (CVE-2017-18869)
      * nodejs-sshpk: ReDoS when parsing crafted invalid public keys in lib/formats/ssh.js (CVE-2018-3737)
      * nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties     (CVE-2018-3750)
      * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)
      * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)
      * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs8 to version 8.17.0 fixes the following issues :

Security issues fixed :

CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing an arbitrary path overwrite and access via 'bin' field (bsc#1159352).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs6 to version 6.17.1 fixes the following issues :

Security issues fixed :

CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing an arbitrary path overwrite and access via 'bin' field (bsc#1159352).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0579 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

    Security Fix(es):

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

    * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)

    * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

    * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

    * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

    * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0579 advisory.

    - Rebase to 10.19.0 to fix CVE-2019-15604 to CVE-2019-15606
    - Rebase to 10.16.3 to fix CVE-2019-9511 to CVE-2019-9518

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0597 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.19.0).

    Security Fix(es):

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

    * nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string     (CVE-2019-15604)

    * nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

    * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

    * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

    * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2625 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs8-nodejs (8.17.0).
    (BZ#1829414)

    Security Fix(es):

    * nodejs-brace-expansion: Regular expression denial of service (CVE-2017-18077)

    * nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js (CVE-2017-18869)

    * nodejs-sshpk: ReDoS when parsing crafted invalid public keys in lib/formats/ssh.js (CVE-2018-3737)

    * nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-3750)

    * npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

    * npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

    * npm: Global node_modules Binary Overwrite (CVE-2019-16777)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
132952	SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2020:0104-1)	Nessus	SuSE Local Security Checks	2020/1/16	2022/5/18	high
133233	Fedora 31 : 1:libuv / 1:nodejs (2020-595ce5e3cc)	Nessus	Fedora Local Security Checks	2020/1/27	2024/3/28	high
133947	SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2020:0429-1)	Nessus	SuSE Local Security Checks	2020/2/24	2024/3/26	critical
294116	MiracleLinux 7 : rh-nodejs12-nodejs-12.16.1-1.el7 (AXSA:2020-4480:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
145979	CentOS 8 : nodejs:10 (CESA-2020:0579)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	critical
132920	openSUSE Security Update : nodejs8 (openSUSE-2020-59)	Nessus	SuSE Local Security Checks	2020/1/15	2024/3/29	high
134028	RHEL 8 : nodejs:10 (RHSA-2020:0573)	Nessus	Red Hat Local Security Checks	2020/2/25	2024/11/7	critical
134776	GLSA-202003-48 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/23	2024/3/21	critical
170354	RHEL 7 : rh-nodejs12-nodejs (RHSA-2020:0602)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/11/7	critical
291716	MiracleLinux 7 : rh-nodejs10-nodejs-10.19.0-1.el7 (AXSA:2020-4479:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
294570	MiracleLinux 7 : rh-nodejs8-nodejs-8.17.0-2.el7 (AXSA:2020-200:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
132744	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2020:0043-1)	Nessus	SuSE Local Security Checks	2020/1/9	2022/5/18	high
133348	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2020:0247-1)	Nessus	SuSE Local Security Checks	2020/1/30	2022/5/18	high
134062	RHEL 8 : nodejs:10 (RHSA-2020:0579)	Nessus	Red Hat Local Security Checks	2020/2/26	2024/11/7	critical
140035	Oracle Linux 8 : nodejs:10 (ELSA-2020-0579)	Nessus	Oracle Linux Local Security Checks	2020/8/28	2024/11/1	critical
170312	RHEL 7 : rh-nodejs10-nodejs (RHSA-2020:0597)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/11/7	critical
170350	RHEL 7 : rh-nodejs8-nodejs (RHSA-2020:2625)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/11/7	critical

检测

插件搜索

high

high

critical

critical

critical

high

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical