csaf_suse - suse-su-2020:0429-1

suse-su-2020:0429-1

Vulnerability from csaf_suse

Published

2020-02-20 12:28

Modified

2020-02-20 12:28

Summary

Security update for nodejs12

Notes

Title of the patch

Security update for nodejs12

Description of the patch

This update for nodejs12 fixes the following issues: nodejs12 was updated to version 12.15.0. Security issues fixed: - CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104). - CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102). - CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103). - CVE-2019-16775: Fixed an arbitrary file write vulnerability (bsc#1159352). - CVE-2019-16776: Fixed an arbitrary file write vulnerability (bsc#1159352). - CVE-2019-16777: Fixed an arbitrary file write vulnerability (bsc#1159352).

Patchnames

SUSE-2020-429,SUSE-SLE-Module-Web-Scripting-12-2020-429

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nodejs12",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nodejs12 fixes the following issues:\n\nnodejs12 was updated to version 12.15.0.\n\nSecurity issues fixed:\n\n- CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).\n- CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).\n- CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).\n- CVE-2019-16775: Fixed an arbitrary file write vulnerability (bsc#1159352).\n- CVE-2019-16776: Fixed an arbitrary file write vulnerability (bsc#1159352).\n- CVE-2019-16777: Fixed an arbitrary file write vulnerability (bsc#1159352).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2020-429,SUSE-SLE-Module-Web-Scripting-12-2020-429",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_0429-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2020:0429-1",
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200429-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2020:0429-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-February/006508.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1159352",
        "url": "https://bugzilla.suse.com/1159352"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1163102",
        "url": "https://bugzilla.suse.com/1163102"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1163103",
        "url": "https://bugzilla.suse.com/1163103"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1163104",
        "url": "https://bugzilla.suse.com/1163104"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-15604 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-15604/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-15605 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-15605/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-15606 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-15606/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-16775 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-16775/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-16776 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-16776/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-16777 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-16777/"
      }
    ],
    "title": "Security update for nodejs12",
    "tracking": {
      "current_release_date": "2020-02-20T12:28:28Z",
      "generator": {
        "date": "2020-02-20T12:28:28Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2020:0429-1",
      "initial_release_date": "2020-02-20T12:28:28Z",
      "revision_history": [
        {
          "date": "2020-02-20T12:28:28Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs12-12.15.0-1.6.1.aarch64",
                "product": {
                  "name": "nodejs12-12.15.0-1.6.1.aarch64",
                  "product_id": "nodejs12-12.15.0-1.6.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs12-devel-12.15.0-1.6.1.aarch64",
                "product": {
                  "name": "nodejs12-devel-12.15.0-1.6.1.aarch64",
                  "product_id": "nodejs12-devel-12.15.0-1.6.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "npm12-12.15.0-1.6.1.aarch64",
                "product": {
                  "name": "npm12-12.15.0-1.6.1.aarch64",
                  "product_id": "npm12-12.15.0-1.6.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs12-docs-12.15.0-1.6.1.noarch",
                "product": {
                  "name": "nodejs12-docs-12.15.0-1.6.1.noarch",
                  "product_id": "nodejs12-docs-12.15.0-1.6.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs12-12.15.0-1.6.1.ppc64le",
                "product": {
                  "name": "nodejs12-12.15.0-1.6.1.ppc64le",
                  "product_id": "nodejs12-12.15.0-1.6.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs12-devel-12.15.0-1.6.1.ppc64le",
                "product": {
                  "name": "nodejs12-devel-12.15.0-1.6.1.ppc64le",
                  "product_id": "nodejs12-devel-12.15.0-1.6.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "npm12-12.15.0-1.6.1.ppc64le",
                "product": {
                  "name": "npm12-12.15.0-1.6.1.ppc64le",
                  "product_id": "npm12-12.15.0-1.6.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs12-12.15.0-1.6.1.s390x",
                "product": {
                  "name": "nodejs12-12.15.0-1.6.1.s390x",
                  "product_id": "nodejs12-12.15.0-1.6.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs12-devel-12.15.0-1.6.1.s390x",
                "product": {
                  "name": "nodejs12-devel-12.15.0-1.6.1.s390x",
                  "product_id": "nodejs12-devel-12.15.0-1.6.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "npm12-12.15.0-1.6.1.s390x",
                "product": {
                  "name": "npm12-12.15.0-1.6.1.s390x",
                  "product_id": "npm12-12.15.0-1.6.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs12-12.15.0-1.6.1.x86_64",
                "product": {
                  "name": "nodejs12-12.15.0-1.6.1.x86_64",
                  "product_id": "nodejs12-12.15.0-1.6.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs12-devel-12.15.0-1.6.1.x86_64",
                "product": {
                  "name": "nodejs12-devel-12.15.0-1.6.1.x86_64",
                  "product_id": "nodejs12-devel-12.15.0-1.6.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm12-12.15.0-1.6.1.x86_64",
                "product": {
                  "name": "npm12-12.15.0-1.6.1.x86_64",
                  "product_id": "npm12-12.15.0-1.6.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Web and Scripting 12",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Web and Scripting 12",
                  "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-web-scripting:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-12.15.0-1.6.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64"
        },
        "product_reference": "nodejs12-12.15.0-1.6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-12.15.0-1.6.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le"
        },
        "product_reference": "nodejs12-12.15.0-1.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-12.15.0-1.6.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x"
        },
        "product_reference": "nodejs12-12.15.0-1.6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-12.15.0-1.6.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64"
        },
        "product_reference": "nodejs12-12.15.0-1.6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-devel-12.15.0-1.6.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64"
        },
        "product_reference": "nodejs12-devel-12.15.0-1.6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-devel-12.15.0-1.6.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le"
        },
        "product_reference": "nodejs12-devel-12.15.0-1.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-devel-12.15.0-1.6.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x"
        },
        "product_reference": "nodejs12-devel-12.15.0-1.6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-devel-12.15.0-1.6.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64"
        },
        "product_reference": "nodejs12-devel-12.15.0-1.6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-docs-12.15.0-1.6.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch"
        },
        "product_reference": "nodejs12-docs-12.15.0-1.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm12-12.15.0-1.6.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64"
        },
        "product_reference": "npm12-12.15.0-1.6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm12-12.15.0-1.6.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le"
        },
        "product_reference": "npm12-12.15.0-1.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm12-12.15.0-1.6.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x"
        },
        "product_reference": "npm12-12.15.0-1.6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm12-12.15.0-1.6.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
        },
        "product_reference": "npm12-12.15.0-1.6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-15604",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-15604"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-15604",
          "url": "https://www.suse.com/security/cve/CVE-2019-15604"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1163104 for CVE-2019-15604",
          "url": "https://bugzilla.suse.com/1163104"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-20T12:28:28Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-15604"
    },
    {
      "cve": "CVE-2019-15605",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-15605"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-15605",
          "url": "https://www.suse.com/security/cve/CVE-2019-15605"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1163102 for CVE-2019-15605",
          "url": "https://bugzilla.suse.com/1163102"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-20T12:28:28Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-15605"
    },
    {
      "cve": "CVE-2019-15606",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-15606"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-15606",
          "url": "https://www.suse.com/security/cve/CVE-2019-15606"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1163103 for CVE-2019-15606",
          "url": "https://bugzilla.suse.com/1163103"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-20T12:28:28Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-15606"
    },
    {
      "cve": "CVE-2019-16775",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-16775"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user\u0027s system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-16775",
          "url": "https://www.suse.com/security/cve/CVE-2019-16775"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159352 for CVE-2019-16775",
          "url": "https://bugzilla.suse.com/1159352"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-20T12:28:28Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-16775"
    },
    {
      "cve": "CVE-2019-16776",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-16776"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user\u0027s system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-16776",
          "url": "https://www.suse.com/security/cve/CVE-2019-16776"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159352 for CVE-2019-16776",
          "url": "https://bugzilla.suse.com/1159352"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-20T12:28:28Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-16776"
    },
    {
      "cve": "CVE-2019-16777",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-16777"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
          "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-16777",
          "url": "https://www.suse.com/security/cve/CVE-2019-16777"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159352 for CVE-2019-16777",
          "url": "https://bugzilla.suse.com/1159352"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.15.0-1.6.1.x86_64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.15.0-1.6.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.aarch64",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.s390x",
            "SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.15.0-1.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-20T12:28:28Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-16777"
    }
  ]
}

CVE-2019-15605 (GCVE-0-2019-15605)

Vulnerability from cvelistv5

Published

2020-02-07 14:55

Modified

2025-04-30 22:24

Severity ?

CWE

CWE-444 - HTTP Request Smuggling ()

Summary

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

References

►

URL

Tags

	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/	vendor-advisory, x_refsource_FEDORA
	https://access.redhat.com/errata/RHSA-2020:0573	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0579	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0597	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0598	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0602	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0703	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0707	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0708	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/202003-48	vendor-advisory, x_refsource_GENTOO
	https://www.debian.org/security/2020/dsa-4669	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://nodejs.org/en/blog/release/v13.8.0/	x_refsource_CONFIRM
	https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/	x_refsource_CONFIRM
	https://nodejs.org/en/blog/release/v10.19.0/	x_refsource_CONFIRM
	https://nodejs.org/en/blog/release/v12.15.0/	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20200221-0004/	x_refsource_CONFIRM
	https://hackerone.com/reports/735748	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	NodeJS	Node	Version: 4.0 ≤ Version: 5.0 ≤ Version: 6.0 ≤ Version: 7.0 ≤ Version: 8.0 ≤ Version: 9.0 ≤ Version: 10.0 ≤ Version: 11.0 ≤ Version: 12.0 ≤ Version: 13.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:49:13.764Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2020-3838c8ea98",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/"
          },
          {
            "name": "FEDORA-2020-47efc31973",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/"
          },
          {
            "name": "RHSA-2020:0573",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0573"
          },
          {
            "name": "RHSA-2020:0579",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0579"
          },
          {
            "name": "RHSA-2020:0597",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0597"
          },
          {
            "name": "RHSA-2020:0598",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0598"
          },
          {
            "name": "RHSA-2020:0602",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0602"
          },
          {
            "name": "openSUSE-SU-2020:0293",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html"
          },
          {
            "name": "RHSA-2020:0703",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0703"
          },
          {
            "name": "RHSA-2020:0707",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0707"
          },
          {
            "name": "RHSA-2020:0708",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0708"
          },
          {
            "name": "GLSA-202003-48",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-48"
          },
          {
            "name": "DSA-4669",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4669"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/release/v13.8.0/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/release/v10.19.0/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/release/v12.15.0/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200221-0004/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/735748"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.19.0",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.15.0",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.8.0",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "HTTP Request Smuggling (CWE-444)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:24:23.404Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "name": "FEDORA-2020-3838c8ea98",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/"
        },
        {
          "name": "FEDORA-2020-47efc31973",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/"
        },
        {
          "name": "RHSA-2020:0573",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0573"
        },
        {
          "name": "RHSA-2020:0579",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0579"
        },
        {
          "name": "RHSA-2020:0597",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0597"
        },
        {
          "name": "RHSA-2020:0598",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0598"
        },
        {
          "name": "RHSA-2020:0602",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0602"
        },
        {
          "name": "openSUSE-SU-2020:0293",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html"
        },
        {
          "name": "RHSA-2020:0703",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0703"
        },
        {
          "name": "RHSA-2020:0707",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0707"
        },
        {
          "name": "RHSA-2020:0708",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0708"
        },
        {
          "name": "GLSA-202003-48",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-48"
        },
        {
          "name": "DSA-4669",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4669"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/release/v13.8.0/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/release/v10.19.0/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/release/v12.15.0/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200221-0004/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/735748"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2019-15605",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "https://github.com/nodejs/node",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "10.19.0, 12.15.0, 13.8.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "HTTP Request Smuggling (CWE-444)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2020-3838c8ea98",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/"
            },
            {
              "name": "FEDORA-2020-47efc31973",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/"
            },
            {
              "name": "RHSA-2020:0573",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0573"
            },
            {
              "name": "RHSA-2020:0579",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0579"
            },
            {
              "name": "RHSA-2020:0597",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0597"
            },
            {
              "name": "RHSA-2020:0598",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0598"
            },
            {
              "name": "RHSA-2020:0602",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0602"
            },
            {
              "name": "openSUSE-SU-2020:0293",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html"
            },
            {
              "name": "RHSA-2020:0703",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0703"
            },
            {
              "name": "RHSA-2020:0707",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0707"
            },
            {
              "name": "RHSA-2020:0708",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0708"
            },
            {
              "name": "GLSA-202003-48",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-48"
            },
            {
              "name": "DSA-4669",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4669"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://nodejs.org/en/blog/release/v13.8.0/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/release/v13.8.0/"
            },
            {
              "name": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/"
            },
            {
              "name": "https://nodejs.org/en/blog/release/v10.19.0/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/release/v10.19.0/"
            },
            {
              "name": "https://nodejs.org/en/blog/release/v12.15.0/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/release/v12.15.0/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200221-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200221-0004/"
            },
            {
              "name": "https://hackerone.com/reports/735748",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/735748"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2019-15605",
    "datePublished": "2020-02-07T14:55:22",
    "dateReserved": "2019-08-26T00:00:00",
    "dateUpdated": "2025-04-30T22:24:23.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-15606 (GCVE-0-2019-15606)

Vulnerability from cvelistv5

Published

2020-02-07 14:58

Modified

2025-04-30 22:24

Severity ?

CWE

CWE-20 - Improper Input Validation ()

Summary

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2020:0573	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0579	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0597	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0598	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0602	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202003-48	vendor-advisory, x_refsource_GENTOO
	https://www.debian.org/security/2020/dsa-4669	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://nodejs.org/en/blog/release/v13.8.0/	x_refsource_CONFIRM
	https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/	x_refsource_CONFIRM
	https://nodejs.org/en/blog/release/v10.19.0/	x_refsource_CONFIRM
	https://nodejs.org/en/blog/release/v12.15.0/	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20200221-0004/	x_refsource_CONFIRM
	https://hackerone.com/reports/730779	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	NodeJS	Node	Version: 4.0 ≤ Version: 5.0 ≤ Version: 6.0 ≤ Version: 7.0 ≤ Version: 8.0 ≤ Version: 9.0 ≤ Version: 10.0 ≤ Version: 11.0 ≤ Version: 12.0 ≤ Version: 13.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:49:13.841Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2020:0573",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0573"
          },
          {
            "name": "RHSA-2020:0579",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0579"
          },
          {
            "name": "RHSA-2020:0597",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0597"
          },
          {
            "name": "RHSA-2020:0598",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0598"
          },
          {
            "name": "RHSA-2020:0602",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0602"
          },
          {
            "name": "openSUSE-SU-2020:0293",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html"
          },
          {
            "name": "GLSA-202003-48",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-48"
          },
          {
            "name": "DSA-4669",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4669"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/release/v13.8.0/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/release/v10.19.0/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/release/v12.15.0/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200221-0004/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/730779"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.19.0",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.15.0",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.8.0",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation (CWE-20)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:24:24.274Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "name": "RHSA-2020:0573",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0573"
        },
        {
          "name": "RHSA-2020:0579",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0579"
        },
        {
          "name": "RHSA-2020:0597",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0597"
        },
        {
          "name": "RHSA-2020:0598",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0598"
        },
        {
          "name": "RHSA-2020:0602",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0602"
        },
        {
          "name": "openSUSE-SU-2020:0293",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html"
        },
        {
          "name": "GLSA-202003-48",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-48"
        },
        {
          "name": "DSA-4669",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4669"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/release/v13.8.0/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/release/v10.19.0/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/release/v12.15.0/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200221-0004/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/730779"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2019-15606",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "https://github.com/nodejs/node",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "10.19.0, 12.15.0, 13.8.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Input Validation (CWE-20)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2020:0573",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0573"
            },
            {
              "name": "RHSA-2020:0579",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0579"
            },
            {
              "name": "RHSA-2020:0597",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0597"
            },
            {
              "name": "RHSA-2020:0598",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0598"
            },
            {
              "name": "RHSA-2020:0602",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0602"
            },
            {
              "name": "openSUSE-SU-2020:0293",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html"
            },
            {
              "name": "GLSA-202003-48",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-48"
            },
            {
              "name": "DSA-4669",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4669"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://nodejs.org/en/blog/release/v13.8.0/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/release/v13.8.0/"
            },
            {
              "name": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/"
            },
            {
              "name": "https://nodejs.org/en/blog/release/v10.19.0/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/release/v10.19.0/"
            },
            {
              "name": "https://nodejs.org/en/blog/release/v12.15.0/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/release/v12.15.0/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200221-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200221-0004/"
            },
            {
              "name": "https://hackerone.com/reports/730779",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/730779"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2019-15606",
    "datePublished": "2020-02-07T14:58:08",
    "dateReserved": "2019-08-26T00:00:00",
    "dateUpdated": "2025-04-30T22:24:24.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-16777 (GCVE-0-2019-16777)

Vulnerability from cvelistv5

Published

2019-12-13 01:00

Modified

2024-08-05 01:24

Severity ?

7.7 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

References

►

URL

Tags

	https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli	x_refsource_MISC
	https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html	vendor-advisory, x_refsource_SUSE
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/	vendor-advisory, x_refsource_FEDORA
	https://access.redhat.com/errata/RHEA-2020:0330	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0573	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0579	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0597	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0602	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/202003-48	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	npm	cli	Version: < 6.13.4 < 6.13.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:47.252Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "openSUSE-SU-2020:0059",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html"
          },
          {
            "name": "FEDORA-2020-595ce5e3cc",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"
          },
          {
            "name": "RHEA-2020:0330",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHEA-2020:0330"
          },
          {
            "name": "RHSA-2020:0573",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0573"
          },
          {
            "name": "RHSA-2020:0579",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0579"
          },
          {
            "name": "RHSA-2020:0597",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0597"
          },
          {
            "name": "RHSA-2020:0602",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0602"
          },
          {
            "name": "GLSA-202003-48",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-48"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cli",
          "vendor": "npm",
          "versions": [
            {
              "lessThan": "6.13.4",
              "status": "affected",
              "version": "\u003c 6.13.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-20T20:06:15",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "openSUSE-SU-2020:0059",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html"
        },
        {
          "name": "FEDORA-2020-595ce5e3cc",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"
        },
        {
          "name": "RHEA-2020:0330",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHEA-2020:0330"
        },
        {
          "name": "RHSA-2020:0573",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0573"
        },
        {
          "name": "RHSA-2020:0579",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0579"
        },
        {
          "name": "RHSA-2020:0597",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0597"
        },
        {
          "name": "RHSA-2020:0602",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0602"
        },
        {
          "name": "GLSA-202003-48",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-48"
        }
      ],
      "source": {
        "advisory": "GHSA-4328-8hgf-7wjr",
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary File Overwrite in npm CLI",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2019-16777",
          "STATE": "PUBLIC",
          "TITLE": "Arbitrary File Overwrite in npm CLI"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "cli",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "\u003c 6.13.4",
                            "version_value": "6.13.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "npm"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli",
              "refsource": "MISC",
              "url": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli"
            },
            {
              "name": "https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr",
              "refsource": "CONFIRM",
              "url": "https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "openSUSE-SU-2020:0059",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html"
            },
            {
              "name": "FEDORA-2020-595ce5e3cc",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"
            },
            {
              "name": "RHEA-2020:0330",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHEA-2020:0330"
            },
            {
              "name": "RHSA-2020:0573",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0573"
            },
            {
              "name": "RHSA-2020:0579",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0579"
            },
            {
              "name": "RHSA-2020:0597",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0597"
            },
            {
              "name": "RHSA-2020:0602",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0602"
            },
            {
              "name": "GLSA-202003-48",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-48"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-4328-8hgf-7wjr",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2019-16777",
    "datePublished": "2019-12-13T01:00:21",
    "dateReserved": "2019-09-24T00:00:00",
    "dateUpdated": "2024-08-05T01:24:47.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-16775 (GCVE-0-2019-16775)

Vulnerability from cvelistv5

Published

2019-12-13 00:55

Modified

2024-08-05 01:24

Severity ?

7.7 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following

Summary

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

References

►

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html	vendor-advisory, x_refsource_SUSE
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/	vendor-advisory, x_refsource_FEDORA
	https://access.redhat.com/errata/RHEA-2020:0330	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0573	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0579	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0597	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0602	vendor-advisory, x_refsource_REDHAT
	https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx	x_refsource_CONFIRM
	https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	npm	cli	Version: < 6.13.3 < 6.13.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:48.326Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2020:0059",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html"
          },
          {
            "name": "FEDORA-2020-595ce5e3cc",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"
          },
          {
            "name": "RHEA-2020:0330",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHEA-2020:0330"
          },
          {
            "name": "RHSA-2020:0573",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0573"
          },
          {
            "name": "RHSA-2020:0579",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0579"
          },
          {
            "name": "RHSA-2020:0597",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0597"
          },
          {
            "name": "RHSA-2020:0602",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0602"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cli",
          "vendor": "npm",
          "versions": [
            {
              "lessThan": "6.13.3",
              "status": "affected",
              "version": "\u003c 6.13.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user\u0027s system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:38:25",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "openSUSE-SU-2020:0059",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html"
        },
        {
          "name": "FEDORA-2020-595ce5e3cc",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"
        },
        {
          "name": "RHEA-2020:0330",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHEA-2020:0330"
        },
        {
          "name": "RHSA-2020:0573",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0573"
        },
        {
          "name": "RHSA-2020:0579",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0579"
        },
        {
          "name": "RHSA-2020:0597",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0597"
        },
        {
          "name": "RHSA-2020:0602",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0602"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli"
        }
      ],
      "source": {
        "advisory": "GHSA-m6cx-g6qm-p2cx",
        "discovery": "UNKNOWN"
      },
      "title": "Unauthorized File Access in npm CLI before before version 6.13.3",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2019-16775",
          "STATE": "PUBLIC",
          "TITLE": "Unauthorized File Access in npm CLI before before version 6.13.3"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "cli",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "\u003c 6.13.3",
                            "version_value": "6.13.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "npm"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user\u0027s system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-61: UNIX Symbolic Link (Symlink) Following"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2020:0059",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html"
            },
            {
              "name": "FEDORA-2020-595ce5e3cc",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"
            },
            {
              "name": "RHEA-2020:0330",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHEA-2020:0330"
            },
            {
              "name": "RHSA-2020:0573",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0573"
            },
            {
              "name": "RHSA-2020:0579",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0579"
            },
            {
              "name": "RHSA-2020:0597",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0597"
            },
            {
              "name": "RHSA-2020:0602",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0602"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx",
              "refsource": "CONFIRM",
              "url": "https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx"
            },
            {
              "name": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli",
              "refsource": "MISC",
              "url": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-m6cx-g6qm-p2cx",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2019-16775",
    "datePublished": "2019-12-13T00:55:15",
    "dateReserved": "2019-09-24T00:00:00",
    "dateUpdated": "2024-08-05T01:24:48.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-15604 (GCVE-0-2019-15604)

Vulnerability from cvelistv5

Published

2020-02-07 14:57

Modified

2025-04-30 22:24

Severity ?

CWE

CWE-295 - Improper Certificate Validation ()

Summary

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2020:0573	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0579	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0597	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0598	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0602	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202003-48	vendor-advisory, x_refsource_GENTOO
	https://www.debian.org/security/2020/dsa-4669	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://hackerone.com/reports/746733	x_refsource_MISC
	https://nodejs.org/en/blog/release/v13.8.0/	x_refsource_CONFIRM
	https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/	x_refsource_CONFIRM
	https://nodejs.org/en/blog/release/v10.19.0/	x_refsource_CONFIRM
	https://nodejs.org/en/blog/release/v12.15.0/	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20200221-0004/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	NodeJS	Node	Version: 4.0 ≤ Version: 5.0 ≤ Version: 6.0 ≤ Version: 7.0 ≤ Version: 8.0 ≤ Version: 9.0 ≤ Version: 10.0 ≤ Version: 11.0 ≤ Version: 12.0 ≤ Version: 13.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:49:13.675Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2020:0573",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0573"
          },
          {
            "name": "RHSA-2020:0579",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0579"
          },
          {
            "name": "RHSA-2020:0597",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0597"
          },
          {
            "name": "RHSA-2020:0598",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0598"
          },
          {
            "name": "RHSA-2020:0602",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0602"
          },
          {
            "name": "openSUSE-SU-2020:0293",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html"
          },
          {
            "name": "GLSA-202003-48",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-48"
          },
          {
            "name": "DSA-4669",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4669"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/746733"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/release/v13.8.0/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/release/v10.19.0/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/release/v12.15.0/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200221-0004/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.19.0",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.15.0",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.8.0",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation (CWE-295)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:24:22.492Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "name": "RHSA-2020:0573",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0573"
        },
        {
          "name": "RHSA-2020:0579",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0579"
        },
        {
          "name": "RHSA-2020:0597",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0597"
        },
        {
          "name": "RHSA-2020:0598",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0598"
        },
        {
          "name": "RHSA-2020:0602",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0602"
        },
        {
          "name": "openSUSE-SU-2020:0293",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html"
        },
        {
          "name": "GLSA-202003-48",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-48"
        },
        {
          "name": "DSA-4669",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4669"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/746733"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/release/v13.8.0/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/release/v10.19.0/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/release/v12.15.0/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200221-0004/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2019-15604",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "https://github.com/nodejs/node",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "10.19.0, 12.15.0, 13.8.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Certificate Validation (CWE-295)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2020:0573",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0573"
            },
            {
              "name": "RHSA-2020:0579",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0579"
            },
            {
              "name": "RHSA-2020:0597",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0597"
            },
            {
              "name": "RHSA-2020:0598",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0598"
            },
            {
              "name": "RHSA-2020:0602",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0602"
            },
            {
              "name": "openSUSE-SU-2020:0293",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html"
            },
            {
              "name": "GLSA-202003-48",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-48"
            },
            {
              "name": "DSA-4669",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4669"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://hackerone.com/reports/746733",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/746733"
            },
            {
              "name": "https://nodejs.org/en/blog/release/v13.8.0/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/release/v13.8.0/"
            },
            {
              "name": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/"
            },
            {
              "name": "https://nodejs.org/en/blog/release/v10.19.0/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/release/v10.19.0/"
            },
            {
              "name": "https://nodejs.org/en/blog/release/v12.15.0/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/release/v12.15.0/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200221-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200221-0004/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2019-15604",
    "datePublished": "2020-02-07T14:57:07",
    "dateReserved": "2019-08-26T00:00:00",
    "dateUpdated": "2025-04-30T22:24:22.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-16776 (GCVE-0-2019-16776)

Vulnerability from cvelistv5

Published

2019-12-13 00:55

Modified

2024-08-05 01:24

Severity ?

7.7 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

References

►

URL

Tags

	https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli	x_refsource_MISC
	https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html	vendor-advisory, x_refsource_SUSE
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/	vendor-advisory, x_refsource_FEDORA
	https://access.redhat.com/errata/RHEA-2020:0330	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0573	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0579	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0597	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0602	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	npm	cli	Version: < 6.13.3 < 6.13.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:48.040Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "openSUSE-SU-2020:0059",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html"
          },
          {
            "name": "FEDORA-2020-595ce5e3cc",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"
          },
          {
            "name": "RHEA-2020:0330",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHEA-2020:0330"
          },
          {
            "name": "RHSA-2020:0573",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0573"
          },
          {
            "name": "RHSA-2020:0579",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0579"
          },
          {
            "name": "RHSA-2020:0597",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0597"
          },
          {
            "name": "RHSA-2020:0602",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0602"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cli",
          "vendor": "npm",
          "versions": [
            {
              "lessThan": "6.13.3",
              "status": "affected",
              "version": "\u003c 6.13.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user\u0027s system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-07T18:33:09",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "openSUSE-SU-2020:0059",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html"
        },
        {
          "name": "FEDORA-2020-595ce5e3cc",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"
        },
        {
          "name": "RHEA-2020:0330",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHEA-2020:0330"
        },
        {
          "name": "RHSA-2020:0573",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0573"
        },
        {
          "name": "RHSA-2020:0579",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0579"
        },
        {
          "name": "RHSA-2020:0597",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0597"
        },
        {
          "name": "RHSA-2020:0602",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0602"
        }
      ],
      "source": {
        "advisory": "GHSA-x8qc-rrcw-4r46",
        "discovery": "UNKNOWN"
      },
      "title": "Unauthorized File Access in npm CLI before before version 6.13.3",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2019-16776",
          "STATE": "PUBLIC",
          "TITLE": "Unauthorized File Access in npm CLI before before version 6.13.3"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "cli",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "\u003c 6.13.3",
                            "version_value": "6.13.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "npm"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user\u0027s system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli",
              "refsource": "MISC",
              "url": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli"
            },
            {
              "name": "https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46",
              "refsource": "CONFIRM",
              "url": "https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "openSUSE-SU-2020:0059",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html"
            },
            {
              "name": "FEDORA-2020-595ce5e3cc",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"
            },
            {
              "name": "RHEA-2020:0330",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHEA-2020:0330"
            },
            {
              "name": "RHSA-2020:0573",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0573"
            },
            {
              "name": "RHSA-2020:0579",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0579"
            },
            {
              "name": "RHSA-2020:0597",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0597"
            },
            {
              "name": "RHSA-2020:0602",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0602"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-x8qc-rrcw-4r46",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2019-16776",
    "datePublished": "2019-12-13T00:55:16",
    "dateReserved": "2019-09-24T00:00:00",
    "dateUpdated": "2024-08-05T01:24:48.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2020:0429-1

Vulnerability from csaf_suse

CVE-2019-15605 (GCVE-0-2019-15605)

Vulnerability from cvelistv5

CVE-2019-15606 (GCVE-0-2019-15606)

Vulnerability from cvelistv5

CVE-2019-16777 (GCVE-0-2019-16777)

Vulnerability from cvelistv5

CVE-2019-16775 (GCVE-0-2019-16775)

Vulnerability from cvelistv5

CVE-2019-15604 (GCVE-0-2019-15604)

Vulnerability from cvelistv5

CVE-2019-16776 (GCVE-0-2019-16776)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature