A flaw was found in Node.js versions before 6.15.0, 8.14.0, 10.14.0 and 11.3.0. A hostname spoofing in URL parser for javascript protocol. If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect. References: https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
Created nodejs tracking bugs for this issue: Affects: epel-all [bug 1661012] Affects: fedora-all [bug 1661011]
Upstream fix: https://github.com/nodejs/node/commit/9c268d049219462de0792284c504f137751cf198
Statement: The nodejs RPMs shipped in Red Hat OpenShift Container Platform (OCP) versions 3.6 through 3.10 are vulnerable to this flaw because they contain the affected code. Later versions of OCP used nodejs RPMs delivered from Red Hat Software Collections and Red Hat Enterprise Linux channels.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:1821 https://access.redhat.com/errata/RHSA-2019:1821
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-12123
The current nodejs releaase in RHOAR 10 rhoar-nodejs10-10.16.0-1.el7 has been rebased and includes these fixes. Hence not affected
In rh-nodejs10-nodejs, this was fixed via the rebase from RHSA-2019:2939 : https://access.redhat.com/errata/RHSA-2019:2939