Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

June 2020 Security Releases

Node.js released security updates for supported release lines addressing TLS session reuse, HTTP/2 settings-frame denial of service, N-API string-buffer memory corruption, and an ICU issue. Node.js 10.21.0, 12.18.0, and 14.4.0 are the listed releases.

Announced

Node.js · Fixed in 10.21.0, 12.18.0, 14.4.0node-addon-apiCVE-2020-8172CVE-2020-11080CVE-2020-8174CVE-2020-10531
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for all supported Node.js release lines for the following issues.

Node.js

Node.js v10.21.0 (LTS)
Affected versions
10.x
Affects Node.js 10.x, 12.x, and 14.x.
12.x
Affects Node.js 12.x, and 14.x.
14.x
Affects Node.js 12.x, and 14.x.
Fixed versions
10.21.0
Node.js v10.21.0 (LTS)
12.18.0
Node.js v12.18.0 (LTS)
14.4.0
Node.js v14.4.0 (Current)
Prerequisites
Not stated in this extraction

node-addon-api

https://www.npmjs.com/package/node-addon-api
Affected versions
1.x
Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally.
2.x
Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally.
Fixed versions
Not stated in this extraction
Prerequisites
when a native add-on is/was built using a version of Node.js that did not support N-API internally
Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally.
Related CVEs
CVE-2020-8172
TLS session reuse can lead to host certificate verification bypass (High) (CVE-2020-8172)
CVE-2020-11080
HTTP/2 Large Settings Frame DoS (Low) (CVE-2020-11080)
CVE-2020-8174
napi_get_value_string_*() allows various kinds of memory corruption (High) (CVE-2020-8174)
CVE-2020-10531
ICU-20958 Prevent SEGV_MAPERR in append (High) (CVE-2020-10531)

Publisher severity

No explicit severity was extracted.

Event
#45589 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 14.4.0 (Current)

Node.js 14.4.0 is a security release fixing TLS certificate verification bypass, HTTP/2 denial of service, and memory corruption vulnerabilities.

Announced

Node.js · Fixed in 14.4.0CVE-2020-8172CVE-2020-11080CVE-2020-8174
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Vulnerabilities fixed: CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).

Node.js

Node.js 14.4.0 (Current)
Affected versions
Not stated in this extraction
Fixed versions
14.4.0
Node.js 14.4.0 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2020-8172
CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass
CVE-2020-11080
CVE-2020-11080: HTTP/2 Large Settings Frame DoS
CVE-2020-8174
CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption

Publisher severity

No explicit severity was extracted.

Event
#45588 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 12.18.0 (LTS)

Node.js 12.18.0 (LTS) is a security release that fixes three vulnerabilities, including TLS certificate verification bypass, HTTP/2 denial of service, and memory corruption issues.

Announced

Node.js · Fixed in 12.18.0CVE-2020-8172CVE-2020-11080CVE-2020-8174
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Vulnerabilities fixed: CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).

Node.js

Node.js 12.18.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
12.18.0
Node.js 12.18.0 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2020-8172
CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High).
CVE-2020-11080
CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low).
CVE-2020-8174
CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).

Publisher severity

No explicit severity was extracted.

Event
#45501 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 10.21.0 (LTS)

Node.js 10.21.0 (LTS) is a security release fixing vulnerabilities in N-API, ICU, and HTTP/2.

Announced

Node.js · Fixed in 10.21.0CVE-2020-8174CVE-2020-10531CVE-2020-11080
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Vulnerabilities fixed:

Node.js

Node.js 10.21.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
10.21.0
Node.js 10.21.0 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2020-8174
CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).
CVE-2020-10531
CVE-2020-10531: ICU-20958 Prevent SEGV_MAPERR in append (High).
CVE-2020-11080
CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low).

Publisher severity

No explicit severity was extracted.

Event
#45406 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement