Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1192
nodejs:12 security update
3 April 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: nodejs:12
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2020-10531
Reference: ESB-2020.1107
ESB-2020.1060
ESB-2020.1015
ESB-2020.0987
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:1293
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: nodejs:12 security update
Advisory ID: RHSA-2020:1293-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1293
Issue date: 2020-04-02
CVE Names: CVE-2020-10531
=====================================================================
1. Summary:
An update for the nodejs:12 module is now available for Red Hat Enterprise
Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64
3. Description:
Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.
Security Fix(es):
* ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1807349 - CVE-2020-10531 ICU: Integer overflow in UnicodeString::doAppend()
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
nodejs-12.16.1-2.module+el8.1.0+6117+b25a342c.src.rpm
nodejs-nodemon-1.18.3-1.module+el8.1.0+3369+37ae6a45.src.rpm
nodejs-packaging-17-3.module+el8.1.0+3369+37ae6a45.src.rpm
aarch64:
nodejs-12.16.1-2.module+el8.1.0+6117+b25a342c.aarch64.rpm
nodejs-debuginfo-12.16.1-2.module+el8.1.0+6117+b25a342c.aarch64.rpm
nodejs-debugsource-12.16.1-2.module+el8.1.0+6117+b25a342c.aarch64.rpm
nodejs-devel-12.16.1-2.module+el8.1.0+6117+b25a342c.aarch64.rpm
npm-6.13.4-1.12.16.1.2.module+el8.1.0+6117+b25a342c.aarch64.rpm
noarch:
nodejs-docs-12.16.1-2.module+el8.1.0+6117+b25a342c.noarch.rpm
nodejs-nodemon-1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch.rpm
nodejs-packaging-17-3.module+el8.1.0+3369+37ae6a45.noarch.rpm
ppc64le:
nodejs-12.16.1-2.module+el8.1.0+6117+b25a342c.ppc64le.rpm
nodejs-debuginfo-12.16.1-2.module+el8.1.0+6117+b25a342c.ppc64le.rpm
nodejs-debugsource-12.16.1-2.module+el8.1.0+6117+b25a342c.ppc64le.rpm
nodejs-devel-12.16.1-2.module+el8.1.0+6117+b25a342c.ppc64le.rpm
npm-6.13.4-1.12.16.1.2.module+el8.1.0+6117+b25a342c.ppc64le.rpm
s390x:
nodejs-12.16.1-2.module+el8.1.0+6117+b25a342c.s390x.rpm
nodejs-debuginfo-12.16.1-2.module+el8.1.0+6117+b25a342c.s390x.rpm
nodejs-debugsource-12.16.1-2.module+el8.1.0+6117+b25a342c.s390x.rpm
nodejs-devel-12.16.1-2.module+el8.1.0+6117+b25a342c.s390x.rpm
npm-6.13.4-1.12.16.1.2.module+el8.1.0+6117+b25a342c.s390x.rpm
x86_64:
nodejs-12.16.1-2.module+el8.1.0+6117+b25a342c.x86_64.rpm
nodejs-debuginfo-12.16.1-2.module+el8.1.0+6117+b25a342c.x86_64.rpm
nodejs-debugsource-12.16.1-2.module+el8.1.0+6117+b25a342c.x86_64.rpm
nodejs-devel-12.16.1-2.module+el8.1.0+6117+b25a342c.x86_64.rpm
npm-6.13.4-1.12.16.1.2.module+el8.1.0+6117+b25a342c.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-10531
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXoWfR9zjgjWX9erEAQg1AhAAodQIYmLQ5BI2VmdcZ9prTjKycXyk4PKR
rGL8jjfPwt+vR9ALg+rVv9siIMxlCJyc7h4Fyp8lp5fx7xmkfnAVYagwMfYdoYZr
U1eTOn491Gi760F9x4nJ/dtaXhp0SXtoGS0RVl1AZsNsLneT1jNaRRSWHsU7qWkg
LQqVLdEcqGIQgX+IlOpfTUje/k3CYG7q7CaPVAloSaXxHTrM6v+7SOsUVFLq3km8
ZepAyZmGEQ3VrV7eYb8HTT5/BRHDqAYazhY9JD6qLt9jWqVvbrCa2XLY382XaS3q
l/qaVvP6Kv77PY7a6/cMJiGgclHjhHbz2pbPdFcrIXR8FdNiz0dFTe8bzMEdjmvL
CWWX4wYJgtbQN8//xXOnJ6WY9XM+cyhxf16hTPIw9Wtu08qMsJDoD/m2mCnFx6Vf
zVrJ47+6pHuCWcM6sRn+Y5z4Iu09XSFovrOzlmvxdiYP8J2SWIkPu6e3ml/KuaBK
HgmQ4BgJLv2YjOqAdaQx+owYEJli7d9XPKz7CHltiJyY7ACUQm1L7VXw7gAXpbix
h1+PJVjiXW1DHXBebytHvS/dAACaTrrnkluGnM9pEjoYecA470Fxi20gVAZG0+0J
oWr9FkDiBIPNVbQ121GWfUz0PKjBM8fKmfHQSVbkcDLPqXOOLpDNbEoei/hVZnSu
6kvhMyD3ku0=
=xGEW
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXoZ6dGaOgq3Tt24GAQjInRAA1sJFUb4Vw93W7Yj5viHhjPXh86D1s41a
hSSzOSjV2jGMiBn5HjgvDTkRLDbiGKoFxjunc0TjsGwpn/l/F+x6kj6qjhqj2PdZ
jlGSbI+cLMKKCojPio8M2G04xJvABWLXx6MeHZb+/ueOI/pukoMFDsqzwjVG/1nS
G/d4LtaePY5yg6mfH8EW2z9iHrsvW3aZlgqJQ4jn3AgaDdmXr4b91JzDk6/Zadh7
niU6IiUd+0VQFfHM+4xgMuDkSJAB9AkO/latiztX8df5GEkVAegBFCnl7gFMKJzf
3mst0GN/C67cyvxGpQeDnYtdY/ikDM9m1cAk1NVo04se+e7nl8a4qMDv73xXdwzX
3L0um2NTfsrae+ZaAOq+epbHRD1XEU1MMM3Ahoi+ZUHeB/GAZmRnKvLg/S1T8kLO
fwdXeNqbxiQo0+vtzHEhmtL8zRb/YRMBWMWq02DdO+v+i6E39k4m9z/loevTcEw7
DLOB2osaeI46hrU2wlp5CAW+yGDmc1sh/jkLex3b8Fqx7ZXU7EW/N3Ekd86wOEpt
n71OZrF2wHmY1pNwe1VhW7N5WHe3N8wvJqVk57AMWxZaSI6KHfooJWgBfzenXKLT
vD2uxDStsKHJnNHC/kc1OMvjBI859RGPJNsos70rYULHcb/5ytBc/n8TjrAJ3jqP
l5GhXy40ixA=
=iE4x
-----END PGP SIGNATURE-----