Описание
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
A TLS Hostname verification bypass vulnerability exists in NodeJS. This flaw allows an attacker to bypass TLS Hostname verification when a TLS client reuses HTTPS sessions.
Отчет
This issue only affects the TLS 1.2 protocol, not TLS 1.3. This issue does not affect NodeJS 10. Red Hat Quay installed NodeJS as a dependency of Yarn. It does not use NodeJS at runtime, but executes Javascript on the client's browser instead. Therefore the impact of this vulnerability on Red Hat Quay is low.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | nodejs:10/nodejs | Not affected | ||
| Red Hat Enterprise Linux 8 | nodejs:14/nodejs | Not affected | ||
| Red Hat Quay 3 | nodejs | Fix deferred | ||
| Red Hat Software Collections | rh-nodejs10-nodejs | Not affected | ||
| Red Hat Enterprise Linux 8 | nodejs | Fixed | RHSA-2020:2852 | 07.07.2020 |
| Red Hat Enterprise Linux 8.1 Extended Update Support | nodejs | Fixed | RHSA-2020:2847 | 07.07.2020 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-nodejs12-nodejs | Fixed | RHSA-2020:2895 | 13.07.2020 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-nodejs12-nodejs | Fixed | RHSA-2020:2895 | 13.07.2020 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-nodejs12-nodejs | Fixed | RHSA-2020:2895 | 13.07.2020 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.4 High
CVSS3
Связанные уязвимости
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
TLS session reuse can lead to host certificate verification bypass in ...
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
Уязвимость реализации протокола TLS программной платформы Node.js, позволяющая нарушителю реализовать атаку типа «человек посередине»
EPSS
7.4 High
CVSS3