CVE-2020-7754

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.(CVE-2020-15095)

This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require( y18n )(); y18n.setLocale( proto ); y18n.updateLocale({polluted: true}); console.log(polluted); // true(CVE-2020-7774)

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.(CVE-2020-7754)

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.(CVE-2020-7788)

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ( Prototype Pollution )(CVE-2021-3918)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.23.1).

Security Fix(es):

• libuv: buffer overflow in realpath (CVE-2020-8252)

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs-dot-prop: prototype pollution (CVE-2020-8116)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• npm: sensitive information exposure through logs (CVE-2020-15095)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

• nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).

Security Fix(es):

• nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

• nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.15.4).

Security Fix(es):

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.23.1).

Security Fix(es):

• libuv: buffer overflow in realpath (CVE-2020-8252)

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs-dot-prop: prototype pollution (CVE-2020-8116)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• npm: sensitive information exposure through logs (CVE-2020-15095)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

• nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).

Security Fix(es):

• nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

• nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.15.4).

Security Fix(es):

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)

TuxCare rebuilt npm-user-validate to address 1 CVE. Fixed in 0.1.2-tuxcare.1.

TuxCare rebuilt npm-user-validate to address 1 CVE. Fixed in 0.1.5-tuxcare.1.

npm-user-validate before version 1.0.1 is vulnerable to a Regular Expression Denial of Service (REDos). The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

Impact

The issue affects the email function. If you use this function to process arbitrary user input with no character limit the application may be susceptible to Denial of Service.

Patches

The issue is patched in version 1.0.1 by improving the regular expression used and also enforcing a 254 character limit.

Workarounds

Restrict the character length to a reasonable degree before passing a value to .emal(); Also, consider doing a more rigorous sanitizing/validation beforehand.

Root has patched CVE-2020-7754 in the npm-user-validate package for Root:npm. Multiple fixed versions available.