CVE:CVE-2020-8287
CNNVD:CNNVD-202101-289
nodejs是是一个基于ChromeV8引擎的JavaScript运行环境通过对Chromev8引擎进行了封装以及使用事件驱动和非阻塞IO的应用让Javascript开发高性能的后台应用成为了可能。
Nodejs 存在环境问题漏洞，攻击者可利用该漏洞通过HTTP Request Smuggling绕过访问限制，以读取或更改数据。以下产品及版本受到影响：before 10.23.1, 12.20.1, 14.15.4, 15.5.1
solution:Upgrade nodejs node.js to a higher version than 10.23.1,12.20.1,14.15.4,15.5.1,and avoid the version [10.0.0,10.23.1),[12.0.0,12.20.1),[14.0.0,14.15.4),[15.0.0,15.5.1); Upgrade debian debian_linux to a higher version than 10.0,and avoid the version 10.0; Upgrade fedoraproject fedora to a higher version than 32,33,and avoid the version 32,33; Upgrade oracle graalvm to a higher version than 19.3.4,20.3.0,and avoid the version 19.3.4,20.3.0; Upgrade siemens sinec_infrastructure_network_services to a higher version than 1.0.1.1,and avoid the version (,1.0.1.1)