rpm package
almalinux/nodejs-packaging
pkg:rpm/almalinux/nodejs-packaging
Vulnerabilities (163)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-32804 | Hig | 8.2 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Aug 3, 2021 | The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into rel | |
| CVE-2021-32803 | Hig | 8.2 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Aug 3, 2021 | The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not e | |
| CVE-2021-22918 | Med | 5.3 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Jul 12, 2021 | Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. Th | |
| CVE-2020-28469 | Med | 5.3 | < 25-1.module_el8.5.0+246+05401605 | 25-1.module_el8.5.0+246+05401605 | Jun 3, 2021 | This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. | |
| CVE-2021-33502 | Hig | 7.5 | < 25-1.module_el8.5.0+246+05401605 | 25-1.module_el8.5.0+246+05401605 | May 24, 2021 | The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs. | |
| CVE-2021-23343 | Med | 5.3 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | May 4, 2021 | All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity. | |
| CVE-2021-23362 | Med | 5.3 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Mar 23, 2021 | The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity. | |
| CVE-2021-27290 | Hig | 7.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Mar 12, 2021 | ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option. | |
| CVE-2021-22884 | Hig | 7.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Mar 3, 2021 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker control | |
| CVE-2021-22883 | Hig | 7.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Mar 3, 2021 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then th | |
| CVE-2020-8287 | Med | 6.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Jan 6, 2021 | Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggl | |
| CVE-2020-8265 | Hig | 8.1 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Jan 6, 2021 | Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If t | |
| CVE-2020-7788 | Hig | 7.3 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Dec 11, 2020 | This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. | |
| CVE-2020-8277 | Hig | 7.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Nov 19, 2020 | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed i | |
| CVE-2020-7774 | Hig | 7.3 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Nov 17, 2020 | The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. | |
| CVE-2020-7754 | Hig | 7.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Oct 27, 2020 | This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters. | |
| CVE-2020-8252 | Hig | 7.8 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Sep 18, 2020 | The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes. | |
| CVE-2020-8201 | Hig | 7.4 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Sep 18, 2020 | Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending | |
| CVE-2020-8174 | Hig | 8.1 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Jul 24, 2020 | napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0. | |
| CVE-2020-15366 | Med | 5.6 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Jul 15, 2020 | An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrus |
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into rel
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not e
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. Th
- affected < 25-1.module_el8.5.0+246+05401605fixed 25-1.module_el8.5.0+246+05401605
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
- affected < 25-1.module_el8.5.0+246+05401605fixed 25-1.module_el8.5.0+246+05401605
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker control
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then th
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggl
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If t
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed i
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrus
Page 7 of 9