Linux · Security advisory · February 25, 2020

RHSA-2020:0598: Security update for 6 packages

RHSA-2020:0598, released February 25, 2020, fixes 3 CVEs across 6 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
3
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.5713
99th percentile

Priority of the 3 CVEs

Patch now 0 Urgent 0 High 3 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsRHEL 81:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-develRHEL 81:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-docsRHEL 81:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-nodemonRHEL 80:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packagingRHEL 80:17-3.module+el8.1.0+3369+37ae6a45
npmRHEL 81:6.13.4-1.12.16.1.1.module+el8.1.0+5811+44509afe

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2019-15605 Node.js 10: HTTP Request Smuggling (CWE-444) 9.8 0.5713 None reported
High CVE-2019-15606 Node.js 10: Improper Input Validation (CWE-20) 9.8 0.2004 None reported
High CVE-2019-15604 Node.js 10: Improper Certificate Validation (CWE-295) 7.5 0.1997 None reported
Showing 1 to 3 of 3 1