RHSA-2021:0485: Moderate: rh-nodejs12-nodejs security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.20.1), rh-nodejs12-nodejs-nodemon (2.0.3).Security Fix(es): nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746) nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747) nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754) nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788) nodejs: use-after-free in the TLS implementation (CVE-2020-8265) nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2021:0485?
The severity of RHSA-2021:0485 is categorized as important.
How do I fix RHSA-2021:0485?
To fix RHSA-2021:0485, upgrade the affected packages to version 12.20.1-1.el7 for rh-nodejs12-nodejs and version 2.0.3-1.el7 for rh-nodejs12-nodejs-nodemon.
Which packages are affected by RHSA-2021:0485?
The affected packages for RHSA-2021:0485 include rh-nodejs12-nodejs, rh-nodejs12-nodejs-nodemon, and their related dependencies.
Is RHSA-2021:0485 applicable to CentOS?
Yes, RHSA-2021:0485 is applicable to CentOS systems that use the Red Hat packages for Node.js.
What changes are made in the RHSA-2021:0485 updates?
The updates in RHSA-2021:0485 include upgrading Node.js to version 12.20.1 and Nodemon to version 2.0.3 to address security vulnerabilities.