Information Exposure Through Log Files Affecting nodejs-devel package, versions <1:10.23.1-1.module+el8.3.0+9642+87902f83


Severity

Recommended
0.0
medium
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.04% (14th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE8-NODEJSDEVEL-2564585
  • published10 Apr 2022
  • disclosed7 Jul 2020

Introduced: 7 Jul 2020

CVE-2020-15095  (opens in a new tab)
CWE-532  (opens in a new tab)

How to fix?

Upgrade Oracle:8 nodejs-devel to version 1:10.23.1-1.module+el8.3.0+9642+87902f83 or higher.
This issue was patched in ELSA-2021-0548.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs-devel package and not the nodejs-devel package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

CVSS Base Scores

version 3.1