Description
- Node.js 8 to 10.15.x:
- OS:
- Scope (install, code, runtime, meta, other?):
- Module (and version) (if relevant):
Is Nodejs vulnerable to ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)?
Red Hat and many other vendors have released patches to patch the ICU buffer overflow issue in their platforms
As we notice, we have ICU being used in Nodejs.
Example: Node 8.x has "icu: '59.1' & Node 10.x has icu: '62.1'
Please see the below links for this ICU vulnerability
https://www.tenable.com/cve/CVE-2020-10531 ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)
https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20201317%20-%20Security%20Advisory
Red Hat has released an update for the nodejs:10 module to address the ICU issue.
I didn't find any reference from Nodejs security on this ICU issue.
Can anybody from Nodejs confirm if Nodejs is vulnerable for this ICU Integer Overflow vulnerability?
Thank you