Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4272 advisory.

  - Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through     log files. The CLI supports URLs like     <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>. The password value is not redacted     and is printed to stdout and also to any generated log files. (CVE-2020-15095)

  - Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before     5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
    (CVE-2020-8116)

  - Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious     payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison     cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the     underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the     HTTP header names. (CVE-2020-8201)

  - The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly     determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256     bytes. (CVE-2020-8252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5086 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.18.4).
    (BZ#1878550, BZ#1888291, BZ#1888298)

    Security Fix(es):

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)

    * nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

    * npm: Sensitive information exposure through logs (CVE-2020-15095)

    * libuv: buffer overflow in realpath (CVE-2020-8252)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4272 advisory.

  - npm: sensitive information exposure through logs (CVE-2020-15095)

  - nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  - nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

  - libuv: buffer overflow in realpath (CVE-2020-8252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202101-07 (NodeJS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in NodeJS. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1581 advisory.

    Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious     payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison     cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the     underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the     HTTP header names. (CVE-2020-8201)

    A flaw was found in Node.js 14.x, in versions before 14.11, where it is vulnerable to a denial of service     caused by delayed requests. When used as an edge server, this flaw allows an attacker to initiate a large     number of HTTP requests, causing resource exhaustion and leaving the service unable to accept new     connections. The highest threat from this vulnerability is to system availability. (CVE-2020-8251)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 14.15.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs12 fixes the following issues :

nodejs12 was updated to 12.18.4 LTS :

  - CVE-2020-8201: Fixed an HTTP Request Smuggling due to     CR-to-Hyphen conversion (bsc#1176605).

  - CVE-2020-8252: Fixed a buffer overflow in realpath     (bsc#1176589).

  - CVE-2020-15095: Fixed an information leak through log     files (bsc#1173937).

Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4903 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

    Security Fix(es):

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)

    * nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

    * npm: Sensitive information exposure through logs (CVE-2020-15095)

    * libuv: buffer overflow in realpath (CVE-2020-8252)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * The nodejs:12/development module is not installable (BZ#1883965)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4272 advisory.

    nodejs     [1:12.18.4-2]
    - Resolves: RHBZ#1883966 - nodejs-devel not installable due to missing brotli
    - Some spec fixes

    [12.18.4-1]
    - Rebase to 12.18.4

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4272 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

    Security Fix(es):

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)

    * nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

    * npm: Sensitive information exposure through logs (CVE-2020-15095)

    * libuv: buffer overflow in realpath (CVE-2020-8252)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * The nodejs:12/development module is not installable (BZ#1883966)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs12 fixes the following issues :

  - nodejs12 was updated to 12.18.4 LTS :

  - CVE-2020-8201: Fixed an HTTP Request Smuggling due to     CR-to-Hyphen conversion (bsc#1176605).

  - CVE-2020-8252: Fixed a buffer overflow in realpath     (bsc#1176589).

  - CVE-2020-15095: Fixed an information leak through log     files (bsc#1173937).

  - Explicitly add -fno-strict-aliasing to CFLAGS to fix     compilation on Aarch64 with gcc10 (bsc#1172686)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The version of Node.js installed on the remote host is prior to 10.22.1 or 12.18.4 or 14.11.0. It is, therefore, affected by multiple vulnerabilities as referenced in the september-2020-security-releases advisory.

  - Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing.
    This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.
    (CVE-2020-8201)

  - Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which     can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout     with a default value of 0 which means it is disabled by default. This should be set when Node.js is used     as an edge server. (CVE-2020-8251)

  - libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow     if the resolved path is longer than 256 bytes. (CVE-2020-8252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Node.js reports :

Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues. HTTP Request Smuggling due to CR-to-Hyphen conversion (High) (CVE-2020-8201) Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.

Impacts :

- All versions of the 14.x and 12.x releases line Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical) (CVE-2020-8251) Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout with a default value of 0 which means it is disabled by default. This should be set when Node.js is used as an edge server, for more details refer to the documentation.

Impacts :

- All versions of the 14.x release line fs.realpath.native on may cause buffer overflow (Medium) (CVE-2020-8252) libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Impacts :

- All versions of the 10.x release line

- All versions of the 12.x release line

- All versions of the 14.x release line before 14.9.0

ID	Name	Product	Family	Severity
184572	Rocky Linux 8 : nodejs:12 (RLSA-2020:4272)	Nessus	Rocky Linux Local Security Checks	high
170332	RHEL 7 : rh-nodejs12-nodejs (RHSA-2020:5086)	Nessus	Red Hat Local Security Checks	high
145813	CentOS 8 : nodejs:12 (CESA-2020:4272)	Nessus	CentOS Local Security Checks	high
144864	GLSA-202101-07 : NodeJS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
144797	Amazon Linux 2 : libuv (ALAS-2021-1581)	Nessus	Amazon Linux Local Security Checks	high
144124	Fedora 33 : 1:nodejs (2020-43d5a372fc)	Nessus	Fedora Local Security Checks	high
143665	SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2020:2812-1)	Nessus	SuSE Local Security Checks	high
143663	SUSE SLES15 Security Update : nodejs12 (SUSE-SU-2020:2813-1)	Nessus	SuSE Local Security Checks	high
142450	RHEL 8 : nodejs:12 (RHSA-2020:4903)	Nessus	Red Hat Local Security Checks	high
141637	Oracle Linux 8 : nodejs:12 (ELSA-2020-4272)	Nessus	Oracle Linux Local Security Checks	high
141536	RHEL 8 : nodejs:12 (RHSA-2020:4272)	Nessus	Red Hat Local Security Checks	high
141276	openSUSE Security Update : nodejs12 (openSUSE-2020-1616)	Nessus	SuSE Local Security Checks	high
140795	Node.js Multiple Vulnerabilities (September 2020 Security Releases)	Nessus	Misc.	high
140627	FreeBSD : Node.js -- September 2020 Security Releases (4ca5894c-f7f1-11ea-8ff8-0022489ad614)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2020-8201

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high