Security
Headlines
HeadlinesLatestCVEs

Headline

RHSA-2022:7821: Red Hat Security Advisory: nodejs:18 security update

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

  • CVE-2022-35255: nodejs: weak randomness in WebCrypto keygen
  • CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields
Red Hat Security Data
#vulnerability#web#linux#red_hat#nodejs#js#java#kubernetes#aws#ibm

Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Virtualization
  • Red Hat Identity Management
  • Red Hat Directory Server
  • Red Hat Certificate System
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Update Infrastructure
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat CloudForms
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • Red Hat CodeReady Workspaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Thorntail
  • Red Hat build of Eclipse Vert.x
  • Red Hat build of OpenJDK
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Process Automation
  • Red Hat Process Automation Manager
  • Red Hat Decision Manager

All Products

Issued:

2022-11-08

Updated:

2022-11-08

RHSA-2022:7821 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Important: nodejs:18 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.9.1). (BZ#2130559, BZ#2131750)

Security Fix(es):

  • nodejs: weak randomness in WebCrypto keygen (CVE-2022-35255)
  • nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 2130517 - CVE-2022-35255 nodejs: weak randomness in WebCrypto keygen
  • BZ - 2130518 - CVE-2022-35256 nodejs: HTTP Request Smuggling due to incorrect parsing of header fields

Red Hat Enterprise Linux for x86_64 8

SRPM

nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.src.rpm

SHA-256: 983e8775d63de0440de6ff6ed9a17f869fefc74e71a3634c105c25cd965faca4

nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.src.rpm

SHA-256: 927e3c4afd119d0230c9293cfa166923c810dd02627edfd89087249fd0e06ad9

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm

SHA-256: f1345ed8ecd3230b52424cb789ff10664a96a3e7eac42f3cc5c5e787e4d393bd

x86_64

nodejs-docs-18.9.1-1.module+el8.7.0+16806+4109802b.noarch.rpm

SHA-256: fc37314a778494e8d56b7da10e411947d767bf75edb3e6dbe8c7cc7ce105e0d3

nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.noarch.rpm

SHA-256: dad46c4f4c3ca4a396c259e47e87df72fdad1d4b2009f469b4e7521d1e1f2583

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: 3ef698eb2f19de97bde0e2e7eb6de64ef1c8370f5c6e4283874b34cce46914d4

nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: d2fd8d3242cc76d52c1eb84fced4f82b629cce882854ec7189f4de1ea47e20b4

nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm

SHA-256: bb23db89084518529bfd92ba00d26608d85a00285659b0ab89cbc7c5bee4ae31

nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm

SHA-256: b9a3892cd02f019eff2fc9ce55c853e69b340ec2368846c8136feb1cf90c1168

nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm

SHA-256: c6c8a70faa1d808454d156636b7f613e525843e5406f7105e4ec62cb7a4a6bc0

nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm

SHA-256: 48a4532bde9936bed2faa05b432e5e682d7a8a6fd018ecb40b87655673c73b6a

nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm

SHA-256: 5a26d99ebc7e9c43edc374bbc30eebe2dadf4bd69798eff63f0dfe094b720558

npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.x86_64.rpm

SHA-256: 312ecd683e9777d354974ff1d352f2f3d80c96fe83277eeade6e5bacb4a4ad75

Red Hat Enterprise Linux for IBM z Systems 8

SRPM

nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.src.rpm

SHA-256: 983e8775d63de0440de6ff6ed9a17f869fefc74e71a3634c105c25cd965faca4

nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.src.rpm

SHA-256: 927e3c4afd119d0230c9293cfa166923c810dd02627edfd89087249fd0e06ad9

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm

SHA-256: f1345ed8ecd3230b52424cb789ff10664a96a3e7eac42f3cc5c5e787e4d393bd

s390x

nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm

SHA-256: 429bde4b5f2575cef2689a710dff9b84601d2e7e1d6b6b2a5b8d6de67f7c604a

nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm

SHA-256: c93035197409fd0380328bac60d8ec63a4ebfcc1172e8036dcddad3200e97f97

nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm

SHA-256: cc733e93221eeb610ac54b368b0404dcbd55b087d8396802ec280f4086f2d049

nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm

SHA-256: 7618278c2fd568d4c51eb4dc2b4d73740a0ddab31de43ebfcbadd5959380b9ca

nodejs-docs-18.9.1-1.module+el8.7.0+16806+4109802b.noarch.rpm

SHA-256: fc37314a778494e8d56b7da10e411947d767bf75edb3e6dbe8c7cc7ce105e0d3

nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm

SHA-256: 50eb179d984030e944f59665def05a4ccb4f85bcd8fa4836d29b0e26d1d9b8d7

nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.noarch.rpm

SHA-256: dad46c4f4c3ca4a396c259e47e87df72fdad1d4b2009f469b4e7521d1e1f2583

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: 3ef698eb2f19de97bde0e2e7eb6de64ef1c8370f5c6e4283874b34cce46914d4

nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: d2fd8d3242cc76d52c1eb84fced4f82b629cce882854ec7189f4de1ea47e20b4

npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.s390x.rpm

SHA-256: cb15472ea99a25a5ef7a58230666fa0e2a282529847bb9f0c3c0683371ea329a

Red Hat Enterprise Linux for Power, little endian 8

SRPM

nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.src.rpm

SHA-256: 983e8775d63de0440de6ff6ed9a17f869fefc74e71a3634c105c25cd965faca4

nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.src.rpm

SHA-256: 927e3c4afd119d0230c9293cfa166923c810dd02627edfd89087249fd0e06ad9

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm

SHA-256: f1345ed8ecd3230b52424cb789ff10664a96a3e7eac42f3cc5c5e787e4d393bd

ppc64le

nodejs-docs-18.9.1-1.module+el8.7.0+16806+4109802b.noarch.rpm

SHA-256: fc37314a778494e8d56b7da10e411947d767bf75edb3e6dbe8c7cc7ce105e0d3

nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.noarch.rpm

SHA-256: dad46c4f4c3ca4a396c259e47e87df72fdad1d4b2009f469b4e7521d1e1f2583

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: 3ef698eb2f19de97bde0e2e7eb6de64ef1c8370f5c6e4283874b34cce46914d4

nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: d2fd8d3242cc76d52c1eb84fced4f82b629cce882854ec7189f4de1ea47e20b4

nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm

SHA-256: fb96cb72b96b8edbbe1c80d323b9d4a7cdb7a06b18ff7ea30a4801ff25173c4b

nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm

SHA-256: 97200a26c455a0b01402f8287c23d9c10dccb598d98a4c0c9b576b7f74bcd32e

nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm

SHA-256: 6730519cbbac73829fe78d09d8b4f0ffbcdb164f757628c4932f17189d4621b5

nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm

SHA-256: 6f839f42548e051908defc042d7af11a96dc524b9e325672f013acdfff716d78

nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm

SHA-256: e2925bb43af1c0a7acbc7b1edc0bee8ad69dd703eac8332a024b52ce04a6e6b2

npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.ppc64le.rpm

SHA-256: 468292ef72e567e99a9cc8c6f018cfb46d3299dff5ceb6fe5ec9afe21163fc15

Red Hat Enterprise Linux for ARM 64 8

SRPM

nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.src.rpm

SHA-256: 983e8775d63de0440de6ff6ed9a17f869fefc74e71a3634c105c25cd965faca4

nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.src.rpm

SHA-256: 927e3c4afd119d0230c9293cfa166923c810dd02627edfd89087249fd0e06ad9

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm

SHA-256: f1345ed8ecd3230b52424cb789ff10664a96a3e7eac42f3cc5c5e787e4d393bd

aarch64

nodejs-docs-18.9.1-1.module+el8.7.0+16806+4109802b.noarch.rpm

SHA-256: fc37314a778494e8d56b7da10e411947d767bf75edb3e6dbe8c7cc7ce105e0d3

nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.noarch.rpm

SHA-256: dad46c4f4c3ca4a396c259e47e87df72fdad1d4b2009f469b4e7521d1e1f2583

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: 3ef698eb2f19de97bde0e2e7eb6de64ef1c8370f5c6e4283874b34cce46914d4

nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: d2fd8d3242cc76d52c1eb84fced4f82b629cce882854ec7189f4de1ea47e20b4

nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm

SHA-256: 0d5d321270e99663b04c6c9d7eb4bf6f9ac7a19ec53c1f06d4ac7da41520f279

nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm

SHA-256: e0d89c8d788eb99342737f93191c4a131b47aa425a4abf08411b18757311581e

nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm

SHA-256: 6c3755bae7407cd7b7376f5ed10edf077f28012611d695d1dbf4e32fcf6fd19b

nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm

SHA-256: ec97622aaf95f7190c698d8b4a38465afd299b5cdfc2f6eda332f00f8e0c8f46

nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm

SHA-256: 696d2f2b33127bb15e37770966233520ea1751f3ad27a88785f77f8f0f64649a

npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.aarch64.rpm

SHA-256: cd1823b50e91532d2ae0b41cb90cbac381235ee1b8f9e6221b84030b31f57a0d

The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.

Related news

Gentoo Linux Security Advisory 202405-29

Gentoo Linux Security Advisory 202405-29 - Multiple vulnerabilities have been discovered in Node.js. Versions greater than or equal to 16.20.2 are affected.

Ubuntu Security Notice USN-6491-1

Ubuntu Security Notice 6491-1 - Axel Chong discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. Zeyu Zhang discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS.

RHSA-2023:1742: Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-35065: A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability. * CVE-2021-44531: A flaw was found in node.js where it accepted a certificate's Subject Alternative Names (SAN) entry...

RHSA-2023:1533: Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-35065: A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability. * CVE-2021-44906: An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to tr...

Debian Security Advisory 5326-1

Debian Linux Security Advisory 5326-1 - Multiple vulnerabilities were discovered in Node.js, which could result in HTTP request smuggling, bypass of host IP address validation and weak randomness setup.

RHSA-2023:0321: Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update

An update for nodejs and nodejs-nodemon is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-44906: minimist: prototype pollution * CVE-2022-3517: nodejs-minimatch: ReDoS via the braceExpand function * CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields * CVE-2022-43548: nodejs: DNS rebinding in inspect via invalid octal IP address

CISA Warns of Flaws in Siemens, GE Digital, and Contec Industrial Control Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published four Industrial Control Systems (ICS) advisories, calling out several security flaws affecting products from Siemens, GE Digital, and Contec. The most critical of the issues have been identified in Siemens SINEC INS that could lead to remote code execution via a path traversal flaw (CVE-2022-45092, CVSS score: 9.9)

CVE-2022-35255

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.

CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

Red Hat Security Advisory 2022-7830-01

Red Hat Security Advisory 2022-7830-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include HTTP request smuggling and bypass vulnerabilities.

Red Hat Security Advisory 2022-7821-01

Red Hat Security Advisory 2022-7821-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a HTTP request smuggling vulnerability.

RHSA-2022:7830: Red Hat Security Advisory: nodejs:14 security update

An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-44531: nodejs: Improper handling of URI Subject Alternative Names * CVE-2021-44532: nodejs: Certificate Verification Bypass via String Injection * CVE-2021-44533: nodejs: Incorrect handling of certificate subject and issuer fields * CVE-2022-21824: nodejs: Prototype pollution via console.table properties * CVE-2022-35256: nodejs: HTTP Reque...

Red Hat Security Advisory 2022-7044-01

Red Hat Security Advisory 2022-7044-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include HTTP request smuggling and bypass vulnerabilities.

RHSA-2022:7044: Red Hat Security Advisory: rh-nodejs14-nodejs security update

An update for rh-nodejs14-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-44531: nodejs: Improper handling of URI Subject Alternative Names * CVE-2021-44532: nodejs: Certificate Verification Bypass via String Injection * CVE-2021-44533: nodejs: Incorrect handling of certificate subject and issuer fields * CVE-2021-44906: minimist: prototype pollution * CVE-2022-21824: nodejs: Prototype pollution via console.table...

Red Hat Security Advisory 2022-6963-01

Red Hat Security Advisory 2022-6963-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a HTTP request smuggling vulnerability.

Red Hat Security Advisory 2022-6963-01

Red Hat Security Advisory 2022-6963-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a HTTP request smuggling vulnerability.

CVE-2022-21587: Oracle Critical Patch Update Advisory - October 2022

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2022-21587: Oracle Critical Patch Update Advisory - October 2022

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Red Hat Security Advisory 2022-6964-01

Red Hat Security Advisory 2022-6964-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a HTTP request smuggling vulnerability.

Red Hat Security Advisory 2022-6964-01

Red Hat Security Advisory 2022-6964-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a HTTP request smuggling vulnerability.

RHSA-2022:6963: Red Hat Security Advisory: nodejs security update

An update for nodejs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-35255: nodejs: weak randomness in WebCrypto keygen * CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields

RHSA-2022:6963: Red Hat Security Advisory: nodejs security update

An update for nodejs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-35255: nodejs: weak randomness in WebCrypto keygen * CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields

RHSA-2022:6964: Red Hat Security Advisory: nodejs:16 security update

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-35255: nodejs: weak randomness in WebCrypto keygen * CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields

RHSA-2022:6964: Red Hat Security Advisory: nodejs:16 security update

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-35255: nodejs: weak randomness in WebCrypto keygen * CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields