The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0551 advisory.

    nodejs     [1:14.15.4-2]
    - Add patch for yarn crash
    - Resolves: RHBZ#1916465

    [1:14.15.4-1]
    - Security rebase to 14.15.4
    - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
    - Resolves: RHBZ#1916463, RHBZ#1914788
    - Resolves: RHBZ#1914785, RHBZ#1916387, RHBZ#1916389, RHBZ#1916390, RHBZ#1916690

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in Node.js, which could result in denial of service and potentially the execution of arbitrary code or HTTP request smuggling.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-d5b2c18fe6 advisory.

  - Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
    The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally     Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and     keep the allocation alive until the session dies. This can consume excess memory. (CVE-2019-9516)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its     TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls     node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method     does not return an error, this object is passed back to the caller as part of a StreamWriteResult     structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other     exploits. (CVE-2020-8265)

  - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP     request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first     header field and ignores the second. This can lead to HTTP Request Smuggling. (CVE-2020-8287)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for nodejs8 fixes the following issue :

CVE-2020-8287: Fixed an HTTP request smuggling vulnerability (bsc#1180554).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0521 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.23.1).

    Security Fix(es):

    * libuv: buffer overflow in realpath (CVE-2020-8252)

    * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

    * nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

    * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)

    * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

    * npm: sensitive information exposure through logs (CVE-2020-15095)

    * nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

    * nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

    * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0549 advisory.

    nodejs     [1:12.20.1-1]
    - Security rebase for January security release
    - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
    - Resolves: RHBZ#1916460, RHBZ#1914786
    - Resolves: RHBZ#1914784, RHBZ#1916396

    nodejs-nodemon     [2.0.3-1]
    - Resolves: RHBZ#1921841, RHBZ#1921843, RHBZ#1921842
    - Rebase to 2.0.3

    nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
146637	Oracle Linux 8 : nodejs:14 (ELSA-2021-0551)	Nessus	Oracle Linux Local Security Checks	2021/2/20	2024/11/2	critical
144824	Debian DSA-4826-1 : nodejs - security update	Nessus	Debian Local Security Checks	2021/1/11	2024/1/30	high
145150	Fedora 32 : 1:nodejs (2021-d5b2c18fe6)	Nessus	Fedora Local Security Checks	2021/1/20	2024/1/29	high
145022	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2021:0121-1)	Nessus	SuSE Local Security Checks	2021/1/15	2024/1/30	medium
165111	RHEL 7 : rh-nodejs10-nodejs (RHSA-2021:0521)	Nessus	Red Hat Local Security Checks	2022/9/15	2024/11/7	critical
146636	Oracle Linux 8 : nodejs:12 (ELSA-2021-0549)	Nessus	Oracle Linux Local Security Checks	2021/2/19	2024/11/1	critical

检测

插件搜索

critical

high

high

medium

critical

critical