Linux · Security advisory · July 7, 2020
RHSA-2020:2852: Security update for 7 packages
RHSA-2020:2852, released July 7, 2020, fixes 4 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0765
94th percentile
Priority of the 4 CVEs
Patch now 0
Urgent 0
High 3
Routine 1
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| nodejs | RHEL 8 | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| nodejs-devel | RHEL 8 | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| nodejs-docs | RHEL 8 | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| nodejs-full-i18n | RHEL 8 | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| nodejs-nodemon | RHEL 8 | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| nodejs-packaging | RHEL 8 | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| npm | RHEL 8 | 1:6.14.5-1.12.18.2.1.module+el8.2.0+7233+61d664c1 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2020-8174 | Node.js 4 and 5 others: Memory Corruption - Generic (CWE-119) | 8.1 | 0.0765 | None reported | |
| High | CVE-2020-8172 | Node.js 14: TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0. | 7.4 | 0.0607 | None reported | |
| High | CVE-2020-11080 | Denial of service in nghttp2 | 7.5 | 0.0532 | None reported | |
| Routine | CVE-2020-7598 | nodejs-docs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 5.6 | 0.0193 | None reported |
Showing 1 to 4 of 4
1