Red Hat Product Errata RHSA-2020:2849 - Security Advisory
Issued:
2020-07-07
Updated:
2020-07-07

RHSA-2020:2849 - Security Advisory

Synopsis

Important: nodejs:10 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

Security Fix(es):

  • nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)
  • nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)
  • nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64

Fixes

  • BZ - 1813344 - CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload
  • BZ - 1844929 - CVE-2020-11080 nghttp2: overly large SETTINGS frames can lead to DoS
  • BZ - 1845256 - CVE-2020-8174 nodejs: memory corruption in napi_get_value_string_* functions

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1

SRPM
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.src.rpm SHA-256: c54c42542328c05d7ca5edcf1fad15902028d8762331c31308b2ac013d8652f0
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.src.rpm SHA-256: fd478f2549e3bbf506de232a248b8fc61f0092d9fe186599745b0785cfc7e0c2
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.src.rpm SHA-256: 01c71dee45a43aeedaa345bfcb877f73db8e5c0af0c606d1f2a2745c3e353f73
x86_64
nodejs-docs-10.21.0-3.module+el8.1.0+7070+fe09e702.noarch.rpm SHA-256: e5930d6c5c2e9d672d7706a97e8f878204e4d06234caa0a3cb0f1646e1d89bc9
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpm SHA-256: 403e2a69dac714c9c946b51af2cbcd1e25bc88c8e762236725d95c457d75d48f
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpm SHA-256: 1e250d01555333a28809fb735793ce8a44b6b88ced07e80024722bd423ad6cda
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: 1bb1b0081badeb63745ea278ab5f2ed85b86d4ae9a62ec63fb259a0090450c3a
nodejs-debuginfo-10.21.0-3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: 113a30544106800b5a5118c105b9fb468e5c00d871ce8d85647fc5ca8b3653a0
nodejs-debugsource-10.21.0-3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: 3c08f41419eabc9f24a291259d7a3f09e02c285dd45ffc6299351138ebdab178
nodejs-devel-10.21.0-3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: 668a3a7319ec291fe64392f8a4cbe153b01b670f6c0d639010577fd5f7dbc7c0
nodejs-full-i18n-10.21.0-3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: ee1bb88cfaa36e3b9a96e98b7cf19e7b00baf2e0e684721b3adaece717518bb1
npm-6.14.4-1.10.21.0.3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: 434cb4beb5616750bca972751177d58dc22f438e2e2d6bc7e4a1ac98ee993d7c

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1

SRPM
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.src.rpm SHA-256: c54c42542328c05d7ca5edcf1fad15902028d8762331c31308b2ac013d8652f0
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.src.rpm SHA-256: fd478f2549e3bbf506de232a248b8fc61f0092d9fe186599745b0785cfc7e0c2
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.src.rpm SHA-256: 01c71dee45a43aeedaa345bfcb877f73db8e5c0af0c606d1f2a2745c3e353f73
s390x
nodejs-docs-10.21.0-3.module+el8.1.0+7070+fe09e702.noarch.rpm SHA-256: e5930d6c5c2e9d672d7706a97e8f878204e4d06234caa0a3cb0f1646e1d89bc9
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpm SHA-256: 403e2a69dac714c9c946b51af2cbcd1e25bc88c8e762236725d95c457d75d48f
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpm SHA-256: 1e250d01555333a28809fb735793ce8a44b6b88ced07e80024722bd423ad6cda
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.s390x.rpm SHA-256: 2fadf2823f1fd253490955d561e2f9821e813e182a19d486d9060279a269d3b6
nodejs-debuginfo-10.21.0-3.module+el8.1.0+7070+fe09e702.s390x.rpm SHA-256: 6430448690ee53a3dfe501f96f03f932b5fad0e1d361a6acebf66f91abd01cff
nodejs-debugsource-10.21.0-3.module+el8.1.0+7070+fe09e702.s390x.rpm SHA-256: 91df987ec118833774e84ee733fc50a2f7897cb526a39c7de1badc251619631e
nodejs-devel-10.21.0-3.module+el8.1.0+7070+fe09e702.s390x.rpm SHA-256: 852de5464fae71ce358fbb293c1405e49f43fa8ddab666739cb3633a9e8c11b4
nodejs-full-i18n-10.21.0-3.module+el8.1.0+7070+fe09e702.s390x.rpm SHA-256: 38580d0408a9ec9e6863f9c15a04ecd1731d4f5f76352ec6265c3d5fd914d605
npm-6.14.4-1.10.21.0.3.module+el8.1.0+7070+fe09e702.s390x.rpm SHA-256: 021ca319c29edb441f7325a4200907fd5fec093fe69b6b380e8ba6a3fc70d622

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1

SRPM
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.src.rpm SHA-256: c54c42542328c05d7ca5edcf1fad15902028d8762331c31308b2ac013d8652f0
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.src.rpm SHA-256: fd478f2549e3bbf506de232a248b8fc61f0092d9fe186599745b0785cfc7e0c2
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.src.rpm SHA-256: 01c71dee45a43aeedaa345bfcb877f73db8e5c0af0c606d1f2a2745c3e353f73
ppc64le
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: dc6827d8052a40f52e5c34dd9f3561f24b26437cd1a9972a76a3d60c51402067
nodejs-debuginfo-10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: 57f7ddd9049ca54f6e089292dd895ca854c474d2a4df23d366b2ce4d045f9082
nodejs-debugsource-10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: 5c6da494743d71df3c993f11ba1c1fc55d2bd118160de422f23d2f55e3ccef0a
nodejs-devel-10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: ff7d5696cd2b6f9c5493b2e7729d2a34104fabe4869cd6f770e260ec7e2c452a
nodejs-docs-10.21.0-3.module+el8.1.0+7070+fe09e702.noarch.rpm SHA-256: e5930d6c5c2e9d672d7706a97e8f878204e4d06234caa0a3cb0f1646e1d89bc9
nodejs-full-i18n-10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: 37c8bdfbb9cebe489072f6a0bf7c644576fb193ca6d9c48e558bc1b5ef92ca76
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpm SHA-256: 403e2a69dac714c9c946b51af2cbcd1e25bc88c8e762236725d95c457d75d48f
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpm SHA-256: 1e250d01555333a28809fb735793ce8a44b6b88ced07e80024722bd423ad6cda
npm-6.14.4-1.10.21.0.3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: b08f710cea24345ea79cb694ae474d2b1b5590b589dea0f5aeea4aa3a57618a9

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1

SRPM
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.src.rpm SHA-256: c54c42542328c05d7ca5edcf1fad15902028d8762331c31308b2ac013d8652f0
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.src.rpm SHA-256: fd478f2549e3bbf506de232a248b8fc61f0092d9fe186599745b0785cfc7e0c2
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.src.rpm SHA-256: 01c71dee45a43aeedaa345bfcb877f73db8e5c0af0c606d1f2a2745c3e353f73
aarch64
nodejs-docs-10.21.0-3.module+el8.1.0+7070+fe09e702.noarch.rpm SHA-256: e5930d6c5c2e9d672d7706a97e8f878204e4d06234caa0a3cb0f1646e1d89bc9
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpm SHA-256: 403e2a69dac714c9c946b51af2cbcd1e25bc88c8e762236725d95c457d75d48f
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpm SHA-256: 1e250d01555333a28809fb735793ce8a44b6b88ced07e80024722bd423ad6cda
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.aarch64.rpm SHA-256: 73862536289cfa50998d1ac28ef64a785df76450a2f727dffb2d5739feb70520
nodejs-debuginfo-10.21.0-3.module+el8.1.0+7070+fe09e702.aarch64.rpm SHA-256: e3d85f8d580cb4a7f048b683cf8a035621debb5fec380af1f6b7645521fd5886
nodejs-debugsource-10.21.0-3.module+el8.1.0+7070+fe09e702.aarch64.rpm SHA-256: 9386ec704c9e94be080412ecf44cb39145d6c27ac7fe57d24d3efc7feb7bcf36
nodejs-devel-10.21.0-3.module+el8.1.0+7070+fe09e702.aarch64.rpm SHA-256: c42b6ff0f453f3d7a8b6f2dfbb46e38825000e7463f549c6f761cce7a56c0c88
nodejs-full-i18n-10.21.0-3.module+el8.1.0+7070+fe09e702.aarch64.rpm SHA-256: e4e9d109f86fad6b543dd9c14323951429b4b4bf70a7a3fd969d0e21bc62f431
npm-6.14.4-1.10.21.0.3.module+el8.1.0+7070+fe09e702.aarch64.rpm SHA-256: 8237b6297656e551d36f5d7f1dbbf1ed19eb912e96a04db6be8ac98c76ed7b2a

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1

SRPM
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.src.rpm SHA-256: c54c42542328c05d7ca5edcf1fad15902028d8762331c31308b2ac013d8652f0
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.src.rpm SHA-256: fd478f2549e3bbf506de232a248b8fc61f0092d9fe186599745b0785cfc7e0c2
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.src.rpm SHA-256: 01c71dee45a43aeedaa345bfcb877f73db8e5c0af0c606d1f2a2745c3e353f73
ppc64le
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: dc6827d8052a40f52e5c34dd9f3561f24b26437cd1a9972a76a3d60c51402067
nodejs-debuginfo-10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: 57f7ddd9049ca54f6e089292dd895ca854c474d2a4df23d366b2ce4d045f9082
nodejs-debugsource-10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: 5c6da494743d71df3c993f11ba1c1fc55d2bd118160de422f23d2f55e3ccef0a
nodejs-devel-10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: ff7d5696cd2b6f9c5493b2e7729d2a34104fabe4869cd6f770e260ec7e2c452a
nodejs-docs-10.21.0-3.module+el8.1.0+7070+fe09e702.noarch.rpm SHA-256: e5930d6c5c2e9d672d7706a97e8f878204e4d06234caa0a3cb0f1646e1d89bc9
nodejs-full-i18n-10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: 37c8bdfbb9cebe489072f6a0bf7c644576fb193ca6d9c48e558bc1b5ef92ca76
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpm SHA-256: 403e2a69dac714c9c946b51af2cbcd1e25bc88c8e762236725d95c457d75d48f
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpm SHA-256: 1e250d01555333a28809fb735793ce8a44b6b88ced07e80024722bd423ad6cda
npm-6.14.4-1.10.21.0.3.module+el8.1.0+7070+fe09e702.ppc64le.rpm SHA-256: b08f710cea24345ea79cb694ae474d2b1b5590b589dea0f5aeea4aa3a57618a9

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1

SRPM
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.src.rpm SHA-256: c54c42542328c05d7ca5edcf1fad15902028d8762331c31308b2ac013d8652f0
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.src.rpm SHA-256: fd478f2549e3bbf506de232a248b8fc61f0092d9fe186599745b0785cfc7e0c2
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.src.rpm SHA-256: 01c71dee45a43aeedaa345bfcb877f73db8e5c0af0c606d1f2a2745c3e353f73
x86_64
nodejs-docs-10.21.0-3.module+el8.1.0+7070+fe09e702.noarch.rpm SHA-256: e5930d6c5c2e9d672d7706a97e8f878204e4d06234caa0a3cb0f1646e1d89bc9
nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpm SHA-256: 403e2a69dac714c9c946b51af2cbcd1e25bc88c8e762236725d95c457d75d48f
nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpm SHA-256: 1e250d01555333a28809fb735793ce8a44b6b88ced07e80024722bd423ad6cda
nodejs-10.21.0-3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: 1bb1b0081badeb63745ea278ab5f2ed85b86d4ae9a62ec63fb259a0090450c3a
nodejs-debuginfo-10.21.0-3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: 113a30544106800b5a5118c105b9fb468e5c00d871ce8d85647fc5ca8b3653a0
nodejs-debugsource-10.21.0-3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: 3c08f41419eabc9f24a291259d7a3f09e02c285dd45ffc6299351138ebdab178
nodejs-devel-10.21.0-3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: 668a3a7319ec291fe64392f8a4cbe153b01b670f6c0d639010577fd5f7dbc7c0
nodejs-full-i18n-10.21.0-3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: ee1bb88cfaa36e3b9a96e98b7cf19e7b00baf2e0e684721b3adaece717518bb1
npm-6.14.4-1.10.21.0.3.module+el8.1.0+7070+fe09e702.x86_64.rpm SHA-256: 434cb4beb5616750bca972751177d58dc22f438e2e2d6bc7e4a1ac98ee993d7c

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.