nodejs:10 security update
エラータID: AXSA:2020-760:01
リリース日:
2020/10/19 Monday - 23:38
題名:
nodejs:10 security update
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- nodejs の nghttp2 には、攻撃者が巨大な HTTP/2 の SETTINGS フレームの
ペイロードによって、サービス拒否を引き起こすことのできる脆弱性が
あります。(CVE-2020-11080)
- nodejs の minimist には、攻撃者が constructor あるいは__proto__ の
ペイロードを利用して、 prototype 汚染攻撃が可能な脆弱性があります。
(CVE-2020-7598)
- nodejs の napi_get_value_string_*() 関数には、多様な
種類のメモリ破損の脆弱性があります。(CVE-2020-8174)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2020-11080
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
CVE-2020-7598
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
CVE-2020-8174
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-10.21.0-3.module+el8+126+22195e33.src.rpm
MD5: f0fcdeab0fe4b8d34a7d09820fd8131e
SHA-256: aec7d60714f7945d6dc22aac77d64fff7a1b0870d8676c2a1d39a66d244ee97a
Size: 50.45 MB
Asianux Server 8 for x86_64
- nodejs-10.21.0-3.module+el8+126+22195e33.x86_64.rpm
MD5: e170c9f65465732333e0510d479ad894
SHA-256: 593bbacf510f33d2165eee4e30cfec28e175be8ac324f7ed5e2e3ef2cb78ef36
Size: 8.85 MB - nodejs-devel-10.21.0-3.module+el8+126+22195e33.x86_64.rpm
MD5: 102b678cbbd7bbd6a62714ab4cf56398
SHA-256: ed86b5afbac4235612aef5bfaae945db0f42f9b040b7b0108d3fdab1fc5a80b9
Size: 161.96 kB - nodejs-docs-10.21.0-3.module+el8+126+22195e33.noarch.rpm
MD5: 039d7e4f1b55e9542592fc079bae0349
SHA-256: 237d6c9191fefd1e461dc6209294c32c88e53a09c9f2f4bad2b303a3c15d25f4
Size: 3.49 MB - npm-6.14.4-1.10.21.0.3.module+el8+126+22195e33.x86_64.rpm
MD5: 7ccdc2fb954f80f9cf9f243cf2a11a00
SHA-256: 2732790e1e21472dd076e4399b2c2e1b56ce638bbf63d6bc88265134523f39ce
Size: 3.83 MB - nodejs-full-i18n-10.21.0-3.module+el8+126+22195e33.x86_64.rpm
MD5: e1ef3c22d403531489fbbfaf06b5c2b8
SHA-256: 33ecb269438ac5797132d27bfda7f8e7887cb0ea490945f46ed1e34f07f9a78c
Size: 7.29 MB
English