napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:2848 advisory.

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

  - minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a     constructor or __proto__ payload. (CVE-2020-7598)

  - napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and <     14.4.0. (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:2852 advisory.

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

  - minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a     constructor or __proto__ payload. (CVE-2020-7598)

  - TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
    (CVE-2020-8172)

  - napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and <     14.4.0. (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6380-1 advisory.

    Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

    (CVE-2019-15604)

    Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2019-15605)

    Alyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a user or an automated system     were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue     to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2019-15606)

    Tobias Niessen discovered that Node.js incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2020-8174)

    It was discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     cause a denial of service. (CVE-2020-8265, CVE-2020-8287)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3084 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.21.0).

    Security Fix(es):

    * ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2895 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.18.2).

    Security Fix(es):

    * ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2852 advisory.

  - nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

  - nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2848 advisory.

  - nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202101-07 (NodeJS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in NodeJS. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for nodejs8 fixes the following issues :

CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).

CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).

CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916)

CVE-2020-15095: Fixed information leak through log files (bsc#1173937).

Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686).

Add Require for nodejs8 when intalling npm8 (bsc#1172728)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2852 advisory.

    - Fix CVE-2020-10531

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2848 advisory.

    - Fixes CVE-2020-11080, CVE-2020-8174, CVE-2020-10531

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

An update of the nodejs10 package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3042 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs8 fixes the following issues :

  - CVE-2020-8174: Fixed multiple memory corruption in     napi_get_value_string_*() (bsc#1172443).

  - CVE-2020-11080: Fixed a potential denial of service when     receiving unreasonably large HTTP/2 SETTINGS frames     (bsc#1172442). 

  - CVE-2020-7598: Fixed an issue which could have tricked     minimist into adding or modifying properties of     Object.prototype (bsc#1166916).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2852 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.18.2).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2848 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2847 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.18.2).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2849 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs6 fixes the following issues :

CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).

CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs12 fixes the following issues :

nodejs12 was updated to version 12.18.0

CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).

CVE-2020-8172: Fixed am issue where TLS session reuse could have led to host certificate verification bypass (bsc#1172441).

CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).

npm was updated to 6.13.6

CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs8 fixes the following issues :

CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).

CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).

CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs10 fixes the following issues :

nodejs10 was updated to version 10.21.0

CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).

CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).

CVE-2020-10531: Fixed an integer overflow in UnicodeString:doAppend() (bsc#1166844).

npm was updated to 6.14.3

CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs10 fixes the following issues :

nodejs10 was updated to version 10.21.0

CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).

CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).

CVE-2020-10531: Fixed an integer overflow in UnicodeString:doAppend() (bsc#1166844).

Fixed an issue with openssl by adding getrandom syscall definition for all Linux platforms (bsc#1162117).

npm was updated to 6.14.3

CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Node.js reports :

Updates are now available for all supported Node.js release lines for the following issues. TLS session reuse can lead to host certificate verification bypass (High) (CVE-2020-8172) The 'session' event could be emitted before the 'secureConnect' event. It should not be, because the connection may fail to be authorized. If it was saved an authorized connection could be established later with the session ticket. Note that the https agent caches sessions, so is vulnerable to this.

The 'session' event will now only be emitted after the 'secureConnect' event, and only for authorized connections. HTTP/2 Large Settings Frame DoS (Low) (CVE-2020-11080) Receiving unreasonably large HTTP/2 SETTINGS frames can consume 100% CPU to process all the settings, blocking all other activities until complete.

The HTTP/2 session frame is limited to 32 settings by default. This can be configured if necessary using the maxSettings option.
napi_get_value_string_*() allows various kinds of memory corruption (High) (CVE-2020-8174) Calling napi_get_value_string_latin1(), napi_get_value_string_utf8(), or napi_get_value_string_utf16() with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf, probably overrunning the length of the buffer.

A exploit has not been reported and it may be difficult but the following is suggested :

- All users of LTS Node.js versions should update to the versions announced in this security post. This will address the issue for any non pre-built add-on.

- Maintainers who support EOL Node.js versions and/or build against a version of Node.js that did not support N-API internally should update to use the new versions of node-addon-api 1.x and 2.x that will be released soon after this announcement. ICU-20958 Prevent SEGV_MAPERR in append (High) (CVE-2020-10531) An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

Fix was applied to 10.x in an abundance of caution, even though there is no known way to trigger the overflow in 10.x.

Two vulnerabilities were discovered in Node.js, which could result in denial of service and potentially the execution of arbitrary code.

ID	Name	Product	Family	Severity
184927	Rocky Linux 8 : nodejs:10 (RLSA-2020:2848)	Nessus	Rocky Linux Local Security Checks	high
184832	Rocky Linux 8 : nodejs:12 (RLSA-2020:2852)	Nessus	Rocky Linux Local Security Checks	high
181613	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : Node.js vulnerabilities (USN-6380-1)	Nessus	Ubuntu Local Security Checks	critical
170336	RHEL 7 : rh-nodejs10-nodejs (RHSA-2020:3084)	Nessus	Red Hat Local Security Checks	high
170284	RHEL 7 : rh-nodejs12-nodejs (RHSA-2020:2895)	Nessus	Red Hat Local Security Checks	high
145951	CentOS 8 : nodejs:12 (CESA-2020:2852)	Nessus	CentOS Local Security Checks	high
145804	CentOS 8 : nodejs:10 (CESA-2020:2848)	Nessus	CentOS Local Security Checks	high
144864	GLSA-202101-07 : NodeJS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
143610	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2020:2800-1)	Nessus	SuSE Local Security Checks	high
138482	Oracle Linux 8 : nodejs:12 (ELSA-2020-2852)	Nessus	Oracle Linux Local Security Checks	high
138481	Oracle Linux 8 : nodejs:10 (ELSA-2020-2848)	Nessus	Oracle Linux Local Security Checks	high
139513	Photon OS 2.0: Nodejs PHSA-2020-2.0-0269	Nessus	PhotonOS Local Security Checks	high
139510	Photon OS 1.0: Nodejs10 PHSA-2020-1.0-0312	Nessus	PhotonOS Local Security Checks	high
139509	Photon OS 1.0: Nodejs PHSA-2020-1.0-0312	Nessus	PhotonOS Local Security Checks	high
138801	RHEL 8 : nodejs:10 (RHSA-2020:3042)	Nessus	Red Hat Local Security Checks	high
138680	openSUSE Security Update : nodejs8 (openSUSE-2020-802)	Nessus	SuSE Local Security Checks	high
138384	RHEL 8 : nodejs:12 (RHSA-2020:2852)	Nessus	Red Hat Local Security Checks	high
138172	RHEL 8 : nodejs:10 (RHSA-2020:2848)	Nessus	Red Hat Local Security Checks	high
138169	RHEL 8 : nodejs:12 (RHSA-2020:2847)	Nessus	Red Hat Local Security Checks	high
138156	RHEL 8 : nodejs:10 (RHSA-2020:2849)	Nessus	Red Hat Local Security Checks	high
137623	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2020:1623-1)	Nessus	SuSE Local Security Checks	high
137618	SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2020:1606-1)	Nessus	SuSE Local Security Checks	high
137603	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2020:1576-1)	Nessus	SuSE Local Security Checks	high
137602	SUSE SLES12 Security Update : nodejs10 (SUSE-SU-2020:1575-1)	Nessus	SuSE Local Security Checks	high
137597	SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2020:1568-1)	Nessus	SuSE Local Security Checks	high
137382	FreeBSD : Node.js -- June 2020 Security Releases (11fcfa8f-ac64-11ea-9dab-000d3ab229d6)	Nessus	FreeBSD Local Security Checks	high
137208	Debian DSA-4696-1 : nodejs - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-8174

high

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high