CVE-2020-15095

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>. The password value is not redacted and is printed to stdout and also to any generated log files.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.(CVE-2020-15095)

This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require( y18n )(); y18n.setLocale( proto ); y18n.updateLocale({polluted: true}); console.log(polluted); // true(CVE-2020-7774)

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.(CVE-2020-7754)

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.(CVE-2020-7788)

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ( Prototype Pollution )(CVE-2021-3918)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

Security Fix(es):

• nodejs-dot-prop: prototype pollution (CVE-2020-8116)

• nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

• npm: Sensitive information exposure through logs (CVE-2020-15095)

• libuv: buffer overflow in realpath (CVE-2020-8252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• The nodejs:12/development module is not installable (BZ#1883966)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.23.1).

Security Fix(es):

• libuv: buffer overflow in realpath (CVE-2020-8252)

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs-dot-prop: prototype pollution (CVE-2020-8116)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• npm: sensitive information exposure through logs (CVE-2020-15095)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

• nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

Security Fix(es):

• nodejs-dot-prop: prototype pollution (CVE-2020-8116)

• nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

• npm: Sensitive information exposure through logs (CVE-2020-15095)

• libuv: buffer overflow in realpath (CVE-2020-8252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• The nodejs:12/development module is not installable (BZ#1883966)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.23.1).

Security Fix(es):

• libuv: buffer overflow in realpath (CVE-2020-8252)

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs-dot-prop: prototype pollution (CVE-2020-8116)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• npm: sensitive information exposure through logs (CVE-2020-15095)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

• nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

TuxCare rebuilt npm to address 1 CVE. Fixed in 6.13.4-tuxcare.1.

This update for nodejs12 fixes the following issues:

• nodejs12 was updated to 12.18.4 LTS:
  • CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).
  • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
  • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
• Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for nodejs8 fixes the following issues:

• CVE-2020-15095: Fixed information leak through log files (bsc#1173937).
• Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686).

This update was imported from the SUSE:SLE-15:Update update project.

This update for nodejs10 fixes the following issues:

• nodejs10 was updated to 10.22.1 LTS:
  • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
  • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
• Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.

This update for nodejs8 fixes the following issues:

• CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).
• CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).
• CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916)
• CVE-2020-15095: Fixed information leak through log files (bsc#1173937).
• Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686).
• Add Require for nodejs8 when intalling npm8 (bsc#1172728)

This update for nodejs12 fixes the following issues:

• nodejs12 was updated to 12.18.4 LTS:
  • CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).
  • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
  • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
• Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

This update for nodejs12 fixes the following issues:

• nodejs12 was updated to 12.18.4 LTS:
  • CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).
  • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
  • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
• Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

This update for nodejs10 fixes the following issues:

• nodejs10 was updated to 10.22.1 LTS:
  • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
  • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
• Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

This update for nodejs10 fixes the following issues:

• nodejs10 was updated to 10.22.1 LTS:
  • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
  • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
• Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

This update for nodejs8 fixes the following issues:

• CVE-2020-15095: Fixed information leak through log files (bsc#1173937).
• Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686).