RHSA-2021:0421MediumCVSS 8.1

Red Hat Security Advisory: rh-nodejs14-nodejs security update

Published
February 4, 2021
Last Modified
November 5, 2026

🔗 CVE IDs covered (7)

CVE-2020-8277 →CVE-2020-8287 →CVE-2020-15366 →CVE-2020-7754 →CVE-2020-7774 →CVE-2020-7788 →CVE-2020-8265 →

📋 Description

CVE-2020-7754 — nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS CVE-2020-7774 — nodejs-y18n: prototype pollution vulnerability CVE-2020-7788 — nodejs-ini: Prototype pollution via malicious INI file CVE-2020-8265 — nodejs: use-after-free in the TLS implementation CVE-2020-8277 — c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS CVE-2020-8287 — nodejs: HTTP request smuggling via two copies of a header field in an http request CVE-2020-15366 — nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

🎯 Affected products52

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs14-nodejs-0:14.15.4-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-nodejs14-nodejs-debuginfo-0:14.15.4-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs14-nodejs-debuginfo-0:14.15.4-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs14-nodejs-debuginfo-0:14.15.4-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs14-nodejs-debuginfo-0:14.15.4-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs14-nodejs-debuginfo-0:14.15.4-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs14-nodejs-debuginfo-0:14.15.4-2.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs14-nodejs-debuginfo-0:14.15.4-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs14-nodejs-debuginfo-0:14.15.4-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs14-nodejs-debuginfo-0:14.15.4-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs14-nodejs-debuginfo-0:14.15.4-2.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-nodejs14-nodejs-devel-0:14.15.4-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs14-nodejs-devel-0:14.15.4-2.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • +22 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (10)