Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
gentooGentoo FoundationGLSA-202003-48
HistoryMar 20, 2020 - 12:00 a.m.

Node.js: Multiple vulnerabilities

2020-03-2000:00:00
Gentoo Foundation
security.gentoo.org
42

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.016

Percentile

87.7%

JSON

Background

Node.js is a JavaScript runtime built on Chrome’s V8 JavaScript engine.

Description

Multiple vulnerabilities have been discovered in Node.js. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly write arbitrary files, cause a Denial of Service condition or can conduct HTTP request splitting attacks.

Workaround

There is no known workaround at this time.

Resolution

All Node.js <12.x users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose "&gt;=net-libs/nodejs-10.19.0"

All Node.js 12.x users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose "&gt;=net-libs/nodejs-12.15.0"
OSVersionArchitecturePackageVersionFilename
Gentooanyallnet-libs/nodejs< 12.15.0UNKNOWN

Related

nessus 55
openvas 29
ibm 38
suse 7
redhat 9
altlinux 4
mageia 1
osv 8
ubuntu 2
oraclelinux 2
f5 2
photon 7
rocky 2
almalinux 2
fedora 2
nodejsblog 4
freebsd 4
cvelist 1
redhatcve 1
nvd 1
cve 1
ubuntucve 5
debiancve 3
prion 3
alpinelinux 1
debian 1
amazon 1
huntr 1
veracode 1
hackerone 1
nessus
nessus
GLSA-202003-48 : Node.js: Multiple vulnerabilities
2020-03-23 00:00:00
openSUSE Security Update : nodejs8 (openSUSE-2019-89)
2019-01-29 00:00:00
SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2019:0118-1)
2019-01-22 00:00:00
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2019:0118-1)
2021-06-09 00:00:00
openSUSE: Security Advisory for nodejs8 (openSUSE-SU-2019:0089-1)
2019-01-29 00:00:00
Node.js Multiple Vulnerabilities (Nov 2018) - Windows
2018-11-29 00:00:00
ibm
ibm
Security Bulletin: API Connect is impacted by multiple nodeJS vulnerabilities (CVE-2018-12122 CVE-2018-12121 CVE-2018-12123 CVE-2018-12116)
2019-03-27 22:45:01
Security Bulletin: Multiple security vulnerabilities in Node.js affect IBM Voice Gateway
2019-02-20 18:30:01
Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management V2018
2019-05-13 23:35:01
suse
suse
Security update for nodejs8 (important)
2019-01-28 00:00:00
Security update for nodejs8 (important)
2020-03-03 00:00:00
Security update for nodejs6 (important)
2019-02-22 00:00:00
redhat
redhat
(RHSA-2019:1821) Important: rh-nodejs8-nodejs security update
2019-07-22 13:09:06
(RHSA-2020:0598) Important: nodejs:12 security update
2020-02-25 13:06:23
(RHSA-2020:0573) Important: nodejs:10 security update
2020-02-24 12:24:24
altlinux
altlinux
Security fix for the ALT Linux 10 package node version 10.14.1-alt1
2018-11-30 00:00:00
Security fix for the ALT Linux 9 package node version 13.8.0-alt1
2020-02-11 00:00:00
Security fix for the ALT Linux 10 package node version 13.8.0-alt1
2020-02-11 00:00:00
mageia
mageia
Updated nodejs packages fix security vulnerabilities
2019-09-15 16:24:16
osv
osv
nodejs vulnerabilities
2021-03-15 21:18:37
Important: nodejs:12 security update
2020-02-25 13:06:23
Important: nodejs:12 security update
2020-02-25 13:06:23
ubuntu
ubuntu
Node.js vulnerabilities
2021-03-15 00:00:00
Node.js vulnerabilities
2023-09-19 00:00:00
oraclelinux
oraclelinux
nodejs:12 security update
2020-02-26 00:00:00
nodejs:10 security update
2020-02-26 00:00:00
f5
f5
K000137093 : Node.js vulnerabilities CVE-2018-7167, CVE-2018-12115, and CVE-2018-12116
2023-10-02 00:00:00
K000137090 : Node.js vulnerabilities CVE-2018-12121, CVE-2018-12122, and CVE-2018-12123
2023-10-02 00:00:00
photon
photon
Critical Photon OS Security Update - PHSA-2020-0060
2020-02-23 00:00:00
Critical Photon OS Security Update - PHSA-2020-3.0-0060
2020-02-23 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-2.0-0093
2018-09-14 00:00:00
rocky
rocky
nodejs:12 security update
2020-02-25 13:06:23
nodejs:10 security update
2020-02-25 07:57:02
almalinux
almalinux
Important: nodejs:12 security update
2020-02-25 13:06:23
Important: nodejs:10 security update
2020-02-25 07:57:02
fedora
fedora
[SECURITY] Fedora 27 Update: nodejs-8.11.3-1.fc27
2018-07-01 22:24:06
[SECURITY] Fedora 28 Update: nodejs-8.11.3-1.fc28
2018-06-18 16:20:43
nodejsblog
nodejsblog
February 2020 Security Releases
2020-02-06 00:00:00
June 2018 Security Releases
2018-06-12 00:00:00
February 2019 Security Releases
2019-02-28 00:00:00
freebsd
freebsd
Node.js -- multiple vulnerabilities
2020-02-06 00:00:00
node.js -- multiple vulnerabilities
2018-06-12 00:00:00
node.js -- multiple vulnerabilities
2018-11-27 00:00:00
cvelist
cvelist
CVE-2019-5737
2019-03-28 16:20:28
redhatcve
redhatcve
CVE-2019-5737
2020-03-01 07:37:24
nvd
nvd
CVE-2019-5737
2019-03-28 17:29:01
cve
cve
CVE-2019-5737
2019-03-28 17:29:01
ubuntucve
ubuntucve
CVE-2019-5737
2019-03-28 00:00:00
CVE-2019-16777
2019-12-13 00:00:00
CVE-2018-12123
2018-11-28 00:00:00
debiancve
debiancve
CVE-2019-5737
2019-03-28 17:29:01
CVE-2018-12115
2018-08-21 12:29:00
CVE-2018-12123
2018-11-28 17:29:00
prion
prion
Design/Logic Flaw
2019-03-28 17:29:00
Design/Logic Flaw
2018-11-28 17:29:00
Code injection
2019-12-13 01:15:00
alpinelinux
alpinelinux
CVE-2019-5737
2019-03-28 17:29:01
debian
debian
[SECURITY] [DSA 4669-1] nodejs security update
2020-04-29 21:05:57
amazon
amazon
Important: http-parser
2020-04-20 19:21:00
huntr
huntr
hostname spoofing via javascript
2022-03-04 10:29:25
veracode
veracode
Denial Of Service (DoS)
2018-11-20 05:23:08
hackerone
hackerone
Node.js: Remotely trigger an assertion on a TLS server with a malformed certificate string
2019-11-26 16:10:02

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.016

Percentile

87.7%

JSON
Related for GLSA-202003-48
nessus55openvas29ibm38suse7redhat9altlinux4mageia1osv8ubuntu2oraclelinux2f52photon7rocky2almalinux2fedora2nodejsblog4freebsd4cvelist1redhatcve1nvd1cve1ubuntucve5debiancve3prion3alpinelinux1debian1amazon1huntr1veracode1hackerone1