RHSA-2020:5086MediumCVSS 7.8

Red Hat Security Advisory: rh-nodejs12-nodejs security update

Published
November 12, 2020
Last Modified
October 30, 2026

🔗 CVE IDs covered (4)

CVE-2020-8116 →CVE-2020-8201 →CVE-2020-8252 →CVE-2020-15095 →

📋 Description

CVE-2020-8116 — nodejs-dot-prop: prototype pollution CVE-2020-8201 — nodejs: HTTP request smuggling due to CR-to-Hyphen conversion CVE-2020-8252 — libuv: buffer overflow in realpath CVE-2020-15095 — npm: sensitive information exposure through logs

🎯 Affected products56

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs12-nodejs-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-nodejs12-nodejs-debuginfo-0:12.18.4-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • +26 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.

🔗 References (7)