SB2021020440 - Red Hat Software Collections update for rh-nodejs14-nodejs
Published: February 4, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Incorrect Regular Expression (CVE-ID: CVE-2020-7754)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
2) Prototype pollution (CVE-ID: CVE-2020-7774)
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request and execute arbitrary JavaScript code.
3) Prototype pollution (CVE-ID: CVE-2020-7788)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation when handling INI files. A remote attacker can pass a specially crafted INI file to the application and perform prototype pollution attacks.
4) Use-after-free (CVE-ID: CVE-2020-8265)
The vulnerability allows a remote attacker to perform a DoS attack..
The vulnerability exists due to a use-after-free error in TLSWrap within the TLS implementation. A remote attacker can send specially crafted data to the service and perform a denial of service (DoS) attack.
5) Resource management error (CVE-ID: CVE-2020-8277)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the application when processing a large number of DNS responses. A Node.js application that allows an attacker to trigger a DNS request
for a host of their choice could trigger a denial of service condition.
6) HTTP request smuggling (CVE-ID: CVE-2020-8287)
The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
7) Prototype pollution (CVE-ID: CVE-2020-15366)
The disclosed vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can inject and execute arbitrary script code.
Remediation
Install update from vendor's website.