This update for nodejs12 fixes the following issues :

nodejs12 was updated to 12.18.4 LTS :

  - CVE-2020-8201: Fixed an HTTP Request Smuggling due to     CR-to-Hyphen conversion (bsc#1176605).

  - CVE-2020-8252: Fixed a buffer overflow in realpath     (bsc#1176589).

  - CVE-2020-15095: Fixed an information leak through log     files (bsc#1173937).

Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 14.15.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202101-07 (NodeJS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in NodeJS. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4272 advisory.

  - npm: sensitive information exposure through logs (CVE-2020-15095)

  - nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  - nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

  - libuv: buffer overflow in realpath (CVE-2020-8252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious     payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison     cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the     underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the     HTTP header names. (CVE-2020-8201)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4272 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

    Security Fix(es):

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)

    * nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

    * npm: Sensitive information exposure through logs (CVE-2020-15095)

    * libuv: buffer overflow in realpath (CVE-2020-8252)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * The nodejs:12/development module is not installable (BZ#1883966)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4272 advisory.

    nodejs     [1:12.18.4-2]
    - Resolves: RHBZ#1883966 - nodejs-devel not installable due to missing brotli
    - Some spec fixes

    [12.18.4-1]
    - Rebase to 12.18.4

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4903 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

    Security Fix(es):

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)

    * nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

    * npm: Sensitive information exposure through logs (CVE-2020-15095)

    * libuv: buffer overflow in realpath (CVE-2020-8252)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * The nodejs:12/development module is not installable (BZ#1883965)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-894:04 advisory.

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)
      * nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)
      * npm: Sensitive information exposure through logs (CVE-2020-15095)
      * libuv: buffer overflow in realpath (CVE-2020-8252)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1581 advisory.

    Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious     payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison     cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the     underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the     HTTP header names. (CVE-2020-8201)

    A flaw was found in Node.js 14.x, in versions before 14.11, where it is vulnerable to a denial of service     caused by delayed requests. When used as an edge server, this flaw allows an attacker to initiate a large     number of HTTP requests, causing resource exhaustion and leaving the service unable to accept new     connections. The highest threat from this vulnerability is to system availability. (CVE-2020-8251)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Node.js reports :

Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues. HTTP Request Smuggling due to CR-to-Hyphen conversion (High) (CVE-2020-8201) Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.

Impacts :

- All versions of the 14.x and 12.x releases line Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical) (CVE-2020-8251) Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout with a default value of 0 which means it is disabled by default. This should be set when Node.js is used as an edge server, for more details refer to the documentation.

Impacts :

- All versions of the 14.x release line fs.realpath.native on may cause buffer overflow (Medium) (CVE-2020-8252) libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Impacts :

- All versions of the 10.x release line

- All versions of the 12.x release line

- All versions of the 14.x release line before 14.9.0

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5086 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.18.4).
    (BZ#1878550, BZ#1888291, BZ#1888298)

    Security Fix(es):

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)

    * nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

    * npm: Sensitive information exposure through logs (CVE-2020-15095)

    * libuv: buffer overflow in realpath (CVE-2020-8252)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-792:01 advisory.

    nodejs-dot-prop: prototype pollution (CVE-2020-8116)     nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)     npm: Sensitive information exposure through logs (CVE-2020-15095)     libuv: buffer overflow in realpath (CVE-2020-8252)     nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)     nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)     nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)     nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 10.22.1 or 12.18.4 or 14.11.0. It is, therefore, affected by multiple vulnerabilities as referenced in the september-2020-security-releases advisory.

  - Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing.
    This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.
    (CVE-2020-8201)

  - Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which     can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout     with a default value of 0 which means it is disabled by default. This should be set when Node.js is used     as an edge server. (CVE-2020-8251)

  - libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow     if the resolved path is longer than 256 bytes. (CVE-2020-8252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4272 advisory.

  - Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through     log files. The CLI supports URLs like     <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>. The password value is not redacted     and is printed to stdout and also to any generated log files. (CVE-2020-15095)

  - Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before     5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
    (CVE-2020-8116)

  - Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious     payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison     cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the     underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the     HTTP header names. (CVE-2020-8201)

  - The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly     determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256     bytes. (CVE-2020-8252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
143665	SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2020:2812-1)	Nessus	SuSE Local Security Checks	2020/12/9	2022/5/11	high
144124	Fedora 33 : 1:nodejs (2020-43d5a372fc)	Nessus	Fedora Local Security Checks	2020/12/14	2024/2/2	high
144864	GLSA-202101-07 : NodeJS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2021/1/12	2024/1/30	high
145813	CentOS 8 : nodejs:12 (CESA-2020:4272)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/25	high
223623	Linux Distros Unpatched Vulnerability : CVE-2020-8201	Nessus	Misc.	2025/3/4	2026/7/6	high
141536	RHEL 8 : nodejs:12 (RHSA-2020:4272)	Nessus	Red Hat Local Security Checks	2020/10/19	2025/3/13	high
141637	Oracle Linux 8 : nodejs:12 (ELSA-2020-4272)	Nessus	Oracle Linux Local Security Checks	2020/10/21	2024/11/1	high
142450	RHEL 8 : nodejs:12 (RHSA-2020:4903)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/11/7	high
294394	MiracleLinux 7 : rh-nodejs12-nodejs-12.18.4-3.el7 (AXSA:2020-894:04)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
144797	Amazon Linux 2 : libuv (ALAS-2021-1581)	Nessus	Amazon Linux Local Security Checks	2021/1/7	2024/12/11	high
140627	FreeBSD : Node.js -- September 2020 Security Releases (4ca5894c-f7f1-11ea-8ff8-0022489ad614)	Nessus	FreeBSD Local Security Checks	2020/9/17	2022/5/12	high
170332	RHEL 7 : rh-nodejs12-nodejs (RHSA-2020:5086)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/11/8	high
293929	MiracleLinux 8 : nodejs:12 (AXSA:2020-792:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/21	high
140795	Node.js Multiple Vulnerabilities (September 2020 Security Releases)	Nessus	Misc.	2020/9/25	2023/9/11	high
184572	Rocky Linux 8 : nodejs:12 (RLSA-2020:4272)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high