Hide Forgot
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0. References: https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/ https://hackerone.com/reports/811502
Created nodejs tracking bugs for this issue: Affects: epel-all [bug 1845254] Affects: fedora-all [bug 1845248] Created nodejs:10/nodejs tracking bugs for this issue: Affects: fedora-all [bug 1845249] Created nodejs:11/nodejs tracking bugs for this issue: Affects: fedora-all [bug 1845250] Created nodejs:12/nodejs tracking bugs for this issue: Affects: fedora-all [bug 1845251] Created nodejs:13/nodejs tracking bugs for this issue: Affects: fedora-all [bug 1845252] Created nodejs:14/nodejs tracking bugs for this issue: Affects: fedora-all [bug 1845253]
Upstream commits: https://github.com/nodejs/node/commit/2e1b41a708a71ee127a5db9c750760f74db494e4 https://github.com/nodejs/node/commit/0932309af2d9d66611cf5387f2cc925a80cb441f
The impact of this vulnerability was reduced to moderate because of the challenges faced by an attacker trying to exploit this vulnerability. In addition to only being able to thwart HTTPS requests which reuse an existing HTTPS session, they would need to be in a privileged network position, such as on the same Wifi network in order to serve malicious HTTPS requests in place of legitimate ones.
Statement: This issue only affects the TLS 1.2 protocol, not TLS 1.3. This issue does not affect NodeJS 10. Red Hat Quay installed NodeJS as a dependency of Yarn. It does not use NodeJS at runtime, but executes Javascript on the client's browser instead. Therefore the impact of this vulnerability on Red Hat Quay is low.
What is the ETA for this fix with RHEL 8 and NodeJS 12? We have a release deadline for July and this CVE is needed.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:2847 https://access.redhat.com/errata/RHSA-2020:2847
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:2852 https://access.redhat.com/errata/RHSA-2020:2852
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-8172
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2020:2895 https://access.redhat.com/errata/RHSA-2020:2895