Linux · Security advisory · February 26, 2020

ELSA-2020-0598: Security update for 6 packages

ELSA-2020-0598, released February 26, 2020, fixes 3 CVEs across 6 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
3
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.5713
99th percentile

Priority of the 3 CVEs

Patch now 0 Urgent 0 High 3 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsol 81:12.16.1-1.module+el8.1.0+5548+c572d87b
nodejs-develol 81:12.16.1-1.module+el8.1.0+5548+c572d87b
nodejs-docsol 81:12.16.1-1.module+el8.1.0+5548+c572d87b
nodejs-nodemonol 80:1.18.3-1.module+el8.1.0+5393+aaf413e3
nodejs-packagingol 80:17-3.module+el8.1.0+5393+aaf413e3
npmol 81:6.13.4-1.12.16.1.1.module+el8.1.0+5548+c572d87b

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2019-15605 Node.js 10: HTTP Request Smuggling (CWE-444) 9.8 0.5713 None reported
High CVE-2019-15606 Node.js 10: Improper Input Validation (CWE-20) 9.8 0.2004 None reported
High CVE-2019-15604 Node.js 10: Improper Certificate Validation (CWE-295) 7.5 0.1997 None reported
Showing 1 to 3 of 3 1