Linux · Security advisory · October 20, 2020

ELSA-2020-4272: Security update for 7 packages

ELSA-2020-4272, released October 20, 2020, fixes 4 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0530
92nd percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 3 Routine 1

Fixed package versions

ProductReleaseFixed in
nodejsol 81:12.18.4-2.module+el8.2.0+7806+0b44ae23
nodejs-develol 81:12.18.4-2.module+el8.2.0+7806+0b44ae23
nodejs-docsol 81:12.18.4-2.module+el8.2.0+7806+0b44ae23
nodejs-full-i18nol 81:12.18.4-2.module+el8.2.0+7806+0b44ae23
nodejs-nodemonol 80:1.18.3-1.module+el8.1.0+5393+aaf413e3
nodejs-packagingol 80:17-3.module+el8.1.0+5393+aaf413e3
npmol 81:6.14.6-1.12.18.4.2.module+el8.2.0+7806+0b44ae23

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2020-8201 Node.js 14: HTTP Request Smuggling (CWE-444) 7.4 0.0530 None reported
High CVE-2020-8116 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.3 0.0308 None reported
High CVE-2020-8252 Node.js 14 and 1 other: Classic Buffer Overflow (CWE-120) 7.8 0.0071 None reported
Routine CVE-2020-15095 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 4.4 0.0040 None reported
Showing 1 to 4 of 4 1