SB2020120120 - Red Hat Software Collections update for rh-nodejs12-nodejs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020120120

SB2020120120 - Red Hat Software Collections update for rh-nodejs12-nodejs

Published: December 1, 2020

Security Bulletin ID SB2020120120
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Prototype pollution (CVE-ID: CVE-2020-15366)

The disclosed vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can inject and execute arbitrary script code.


2) Prototype pollution (CVE-ID: CVE-2020-7774)

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request and execute arbitrary JavaScript code.



3) Resource management error (CVE-ID: CVE-2020-8277)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing a large number of DNS responses. A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a denial of service condition.


Remediation

Install update from vendor's website.

References