An update of the cmake package has been released.

An update of the mysql package has been released.

Node.js reports :

Updates are now available for all supported Node.js release lines for the following issues. TLS session reuse can lead to host certificate verification bypass (High) (CVE-2020-8172) The 'session' event could be emitted before the 'secureConnect' event. It should not be, because the connection may fail to be authorized. If it was saved an authorized connection could be established later with the session ticket. Note that the https agent caches sessions, so is vulnerable to this.

The 'session' event will now only be emitted after the 'secureConnect' event, and only for authorized connections. HTTP/2 Large Settings Frame DoS (Low) (CVE-2020-11080) Receiving unreasonably large HTTP/2 SETTINGS frames can consume 100% CPU to process all the settings, blocking all other activities until complete.

The HTTP/2 session frame is limited to 32 settings by default. This can be configured if necessary using the maxSettings option.
napi_get_value_string_*() allows various kinds of memory corruption (High) (CVE-2020-8174) Calling napi_get_value_string_latin1(), napi_get_value_string_utf8(), or napi_get_value_string_utf16() with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf, probably overrunning the length of the buffer.

A exploit has not been reported and it may be difficult but the following is suggested :

- All users of LTS Node.js versions should update to the versions announced in this security post. This will address the issue for any non pre-built add-on.

- Maintainers who support EOL Node.js versions and/or build against a version of Node.js that did not support N-API internally should update to use the new versions of node-addon-api 1.x and 2.x that will be released soon after this announcement. ICU-20958 Prevent SEGV_MAPERR in append (High) (CVE-2020-10531) An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

Fix was applied to 10.x in an abundance of caution, even though there is no known way to trigger the overflow in 10.x.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-760:01 advisory.

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)         nodejs-minimist: prototype pollution allows adding or modifying properties     of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)
    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)     CVE-2020-11080     In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection.
    CVE-2020-7598     minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a     constructor or __proto__ payload.
    CVE-2020-8174     napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and <     14.4.0.
    Modularity name: nodejs     Stream name: 10

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5765 advisory.

    - x86/speculation: Add SRBDS vulnerability and mitigation documentation (Mark Gross)  [Orabug: 31446720]     {CVE-2020-0543}
    - x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Mark Gross)  [Orabug:
    31446720]  {CVE-2020-0543}
    - x86/cpu: Add 'table' argument to cpu_matches() (Mark Gross)  [Orabug: 31446720]  {CVE-2020-0543}
    - x86/cpu: Add a steppings field to struct x86_cpu_id (Mark Gross)  [Orabug: 31446720]  {CVE-2020-0543}
    - Address Kata CVE-2020-2023
    - Address Kata CVE-2020-2024
    - Address Kata CVE-2020-2025
    - Address Kata CVE-2020-2026

    kata
    - Address CVE-2020-2023
    - Address CVE-2020-2024
    - Address CVE-2020-2025
    - Address CVE-2020-2026

    kubernetes
    - CVE-2020-8559: Privilege escalation from compromised node to cluster
    - CVE-2020-8557: Node disk DOS by writing to container /etc/hosts
    - Update dependency on Kata containers to a build that includes fixes for CVE-2020-2023 thru CVE-2020-2026

    kubernetes
    - CVE-2020-15104:
      Incorrect validation of wildcard DNS Subject Alternative Names
    - CVE-2020-8559: Privilege escalation from compromised node to cluster
    - CVE-2020-8557: Node disk DOS by writing to container /etc/hosts
    - Update Kubernetes to use Kata 1.7.3-1.0.7 to address CVE-2020-2023 thru CVE-2020-2026

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-326:01 advisory.

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2848 advisory.

  - nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2523 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2852 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.18.2).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2850 advisory.

    libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-2755 advisory.

    - prevent DoS caused by overly large SETTINGS frames (CVE-2020-11080)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
332524	Photon OS 5.0: Cmake PHSA-2023-5.0-91-0035	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	critical
148357	Photon OS 4.0: Mysql PHSA-2021-4.0-0007	Nessus	PhotonOS Local Security Checks	2021/4/7	2025/8/22	critical
137382	FreeBSD : Node.js -- June 2020 Security Releases (11fcfa8f-ac64-11ea-9dab-000d3ab229d6)	Nessus	FreeBSD Local Security Checks	2020/6/12	2024/3/7	high
291709	MiracleLinux 8 : nodejs:10 (AXSA:2020-760:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/20	high
180974	Oracle Linux 7 : Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes kubernetes istio olcne (ELSA-2020-5765)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/2/9	high
294571	MiracleLinux 8 : nghttp2-1.33.0-3.el8.1 (AXSA:2020-326:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/21	high
145804	CentOS 8 : nodejs:10 (CESA-2020:2848)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/25	high
137330	RHEL 8 : Red Hat OpenShift Service Mesh 1.1.2 servicemesh-proxy (RHSA-2020:2523)	Nessus	Red Hat Local Security Checks	2020/6/11	2024/11/7	high
138384	RHEL 8 : nodejs:12 (RHSA-2020:2852)	Nessus	Red Hat Local Security Checks	2020/7/13	2025/3/13	high
138170	RHEL 8 : nghttp2 (RHSA-2020:2850)	Nessus	Red Hat Local Security Checks	2020/7/7	2024/11/7	high
137871	Oracle Linux 8 : nghttp2 (ELSA-2020-2755)	Nessus	Oracle Linux Local Security Checks	2020/6/29	2024/11/1	high

检测

插件搜索

critical

critical

high

high

high

high

high

high

high

high

high