Linux · Security advisory · February 20, 2021

ELSA-2021-0551: Security update for 7 packages

ELSA-2021-0551, released February 20, 2021, fixes 7 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.6959
99th percentile

Priority of the 7 CVEs

Patch now 0 Urgent 0 High 5 Routine 2

Fixed package versions

ProductReleaseFixed in
nodejsol 81:14.15.4-2.module+el8.3.0+9657+a08a905a
nodejs-develol 81:14.15.4-2.module+el8.3.0+9657+a08a905a
nodejs-docsol 81:14.15.4-2.module+el8.3.0+9657+a08a905a
nodejs-full-i18nol 81:14.15.4-2.module+el8.3.0+9657+a08a905a
nodejs-nodemonol 80:2.0.3-1.module+el8.3.0+7818+6cd30d85
nodejs-packagingol 80:23-3.module+el8.3.0+7818+6cd30d85
npmol 81:6.14.10-1.14.15.4.2.module+el8.3.0+9657+a08a905a

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2020-7774 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.3 0.6959 None reported
High CVE-2020-8277 Node.js 14 and 2 others: Denial of Service (CWE-400) 7.5 0.5416 None reported
High CVE-2020-8265 Node.js 14 and 3 others: Use After Free (CWE-416) 8.1 0.0912 None reported
High CVE-2020-7788 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 9.8 0.0366 None reported
High CVE-2020-7754 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.0348 None reported
Routine CVE-2020-8287 Node.js 14 and 3 others: HTTP Request Smuggling (CWE-444) 6.5 0.1630 None reported
Routine CVE-2020-15366 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 5.6 0.0231 None reported
Showing 1 to 7 of 7 1