From 9d9b2b96740807ae005915f3a3d212557b52f1ed Mon Sep 17 00:00:00 2001 From: "Bradley T. Hughes" Date: Wed, 7 Apr 2021 05:35:50 +0000 Subject: security/vuxml: document Node.js April 2021 Security Releases https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/ --- security/vuxml/vuln.xml | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 4258c7cae6a7..0d7043ae2928 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -76,6 +76,53 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + Node.js -- April 2021 Security Releases + + + node10 + 10.24.1 + + + node12 + 12.22.1 + + + node14 + 14.16.1 + + + node + 15.14.0 + + + + +

Node.js reports:

+
OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)
+
This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
+
OpenSSL - NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)
+
This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
+
npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)
+
This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh
+

+ + + + https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/ + https://www.openssl.org/news/secadv/20210325.txt + https://github.com/advisories/GHSA-c4w7-xm78-47vh + CVE-2021-3450 + CVE-2021-3449 + CVE-2020-7774 + + + 2021-04-06 + 2021-04-07 + + + FreeBSD -- jail escape possible by mounting over jail root -- cgit v1.2.3