This update for nodejs10 fixes the following issues :

New upstream LTS version 10.23.1 :

  - CVE-2020-8265: use-after-free in TLSWrap (High) bug in     TLS implementation. When writing to a TLS enabled     socket, node::StreamBase::Write calls     node::TLSWrap::DoWrite with a freshly allocated     WriteWrap object as first argument. If the DoWrite     method does not return an error, this object is passed     back to the caller as part of a StreamWriteResult     structure. This may be exploited to corrupt memory     leading to a Denial of Service or potentially other     exploits (bsc#1180553)

  - CVE-2020-8287: HTTP Request Smuggling allow two copies     of a header field in a http request. For example, two     Transfer-Encoding header fields. In this case Node.js     identifies the first header field and ignores the     second. This can lead to HTTP Request Smuggling     (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)

  - CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer     de-reference (High) This is a vulnerability in OpenSSL     which may be exploited through Node.js. (bsc#1179491)

New upstream LTS version 10.23.0 :

  - deps: upgrade npm to 6.14.8

  - n-api :

  + create N-API version 7

  + expose napi_build_version variable

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202101-07 (NodeJS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in NodeJS. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0551 advisory.

    nodejs     [1:14.15.4-2]
    - Add patch for yarn crash
    - Resolves: RHBZ#1916465

    [1:14.15.4-1]
    - Security rebase to 14.15.4
    - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
    - Resolves: RHBZ#1916463, RHBZ#1914788
    - Resolves: RHBZ#1914785, RHBZ#1916387, RHBZ#1916389, RHBZ#1916390, RHBZ#1916690

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6380-1 advisory.

    Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

    (CVE-2019-15604)

    Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2019-15605)

    Alyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a user or an automated system     were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue     to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2019-15606)

    Tobias Niessen discovered that Node.js incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2020-8174)

    It was discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     cause a denial of service. (CVE-2020-8265, CVE-2020-8287)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0016 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-15366:
    An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully     crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While     untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of     service, not execution of code.)

    CVE-2020-7754:
    This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took     exponentially longer to process long input strings beginning with @ characters.

    CVE-2020-7774:
    This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require('y18n')();
    y18n.setLocale('__proto__'); y18n.updateLocale({polluted: true}); console.log(polluted); // true

    CVE-2020-7788:
    This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application     that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited     further depending on the context.

    CVE-2020-8265:
    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its     TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls     node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method     does not return an error, this object is passed back to the caller as part of a StreamWriteResult     structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other     exploits.

    CVE-2020-8277:
    A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could     trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to     resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

    CVE-2020-8287:
    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP     request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first     header field and ignores the second. This can lead to HTTP Request Smuggling.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
144911	SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2021:0060-1)	Nessus	SuSE Local Security Checks	2021/1/13	2024/1/30	high
144864	GLSA-202101-07 : NodeJS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2021/1/12	2024/1/30	high
146637	Oracle Linux 8 : nodejs:14 (ELSA-2021-0551)	Nessus	Oracle Linux Local Security Checks	2021/2/20	2024/11/2	critical
181613	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : Node.js vulnerabilities (USN-6380-1)	Nessus	Ubuntu Local Security Checks	2023/9/19	2025/9/3	critical
236498	Alibaba Cloud Linux 3 : 0016: nodejs:14 (ALINUX3-SA-2021:0016)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/15	critical

检测

插件搜索

high

high

critical

critical

critical