Headline
RHSA-2022:7821: Red Hat Security Advisory: nodejs:18 security update
An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2022-35255: nodejs: weak randomness in WebCrypto keygen
- CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Virtualization
- Red Hat Identity Management
- Red Hat Directory Server
- Red Hat Certificate System
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Update Infrastructure
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat CloudForms
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- Red Hat CodeReady Workspaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Thorntail
- Red Hat build of Eclipse Vert.x
- Red Hat build of OpenJDK
- Red Hat build of Quarkus
Integration and Automation
- Red Hat Process Automation
- Red Hat Process Automation Manager
- Red Hat Decision Manager
All Products
Issued:
2022-11-08
Updated:
2022-11-08
RHSA-2022:7821 - Security Advisory
- Overview
- Updated Packages
Synopsis
Important: nodejs:18 security update
Type/Severity
Security Advisory: Important
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (18.9.1). (BZ#2130559, BZ#2131750)
Security Fix(es):
- nodejs: weak randomness in WebCrypto keygen (CVE-2022-35255)
- nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
- Red Hat Enterprise Linux for x86_64 8 x86_64
- Red Hat Enterprise Linux for IBM z Systems 8 s390x
- Red Hat Enterprise Linux for Power, little endian 8 ppc64le
- Red Hat Enterprise Linux for ARM 64 8 aarch64
Fixes
- BZ - 2130517 - CVE-2022-35255 nodejs: weak randomness in WebCrypto keygen
- BZ - 2130518 - CVE-2022-35256 nodejs: HTTP Request Smuggling due to incorrect parsing of header fields
Red Hat Enterprise Linux for x86_64 8
SRPM
nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.src.rpm
SHA-256: 983e8775d63de0440de6ff6ed9a17f869fefc74e71a3634c105c25cd965faca4
nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.src.rpm
SHA-256: 927e3c4afd119d0230c9293cfa166923c810dd02627edfd89087249fd0e06ad9
nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm
SHA-256: f1345ed8ecd3230b52424cb789ff10664a96a3e7eac42f3cc5c5e787e4d393bd
x86_64
nodejs-docs-18.9.1-1.module+el8.7.0+16806+4109802b.noarch.rpm
SHA-256: fc37314a778494e8d56b7da10e411947d767bf75edb3e6dbe8c7cc7ce105e0d3
nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.noarch.rpm
SHA-256: dad46c4f4c3ca4a396c259e47e87df72fdad1d4b2009f469b4e7521d1e1f2583
nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm
SHA-256: 3ef698eb2f19de97bde0e2e7eb6de64ef1c8370f5c6e4283874b34cce46914d4
nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm
SHA-256: d2fd8d3242cc76d52c1eb84fced4f82b629cce882854ec7189f4de1ea47e20b4
nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm
SHA-256: bb23db89084518529bfd92ba00d26608d85a00285659b0ab89cbc7c5bee4ae31
nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm
SHA-256: b9a3892cd02f019eff2fc9ce55c853e69b340ec2368846c8136feb1cf90c1168
nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm
SHA-256: c6c8a70faa1d808454d156636b7f613e525843e5406f7105e4ec62cb7a4a6bc0
nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm
SHA-256: 48a4532bde9936bed2faa05b432e5e682d7a8a6fd018ecb40b87655673c73b6a
nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm
SHA-256: 5a26d99ebc7e9c43edc374bbc30eebe2dadf4bd69798eff63f0dfe094b720558
npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.x86_64.rpm
SHA-256: 312ecd683e9777d354974ff1d352f2f3d80c96fe83277eeade6e5bacb4a4ad75
Red Hat Enterprise Linux for IBM z Systems 8
SRPM
nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.src.rpm
SHA-256: 983e8775d63de0440de6ff6ed9a17f869fefc74e71a3634c105c25cd965faca4
nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.src.rpm
SHA-256: 927e3c4afd119d0230c9293cfa166923c810dd02627edfd89087249fd0e06ad9
nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm
SHA-256: f1345ed8ecd3230b52424cb789ff10664a96a3e7eac42f3cc5c5e787e4d393bd
s390x
nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm
SHA-256: 429bde4b5f2575cef2689a710dff9b84601d2e7e1d6b6b2a5b8d6de67f7c604a
nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm
SHA-256: c93035197409fd0380328bac60d8ec63a4ebfcc1172e8036dcddad3200e97f97
nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm
SHA-256: cc733e93221eeb610ac54b368b0404dcbd55b087d8396802ec280f4086f2d049
nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm
SHA-256: 7618278c2fd568d4c51eb4dc2b4d73740a0ddab31de43ebfcbadd5959380b9ca
nodejs-docs-18.9.1-1.module+el8.7.0+16806+4109802b.noarch.rpm
SHA-256: fc37314a778494e8d56b7da10e411947d767bf75edb3e6dbe8c7cc7ce105e0d3
nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm
SHA-256: 50eb179d984030e944f59665def05a4ccb4f85bcd8fa4836d29b0e26d1d9b8d7
nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.noarch.rpm
SHA-256: dad46c4f4c3ca4a396c259e47e87df72fdad1d4b2009f469b4e7521d1e1f2583
nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm
SHA-256: 3ef698eb2f19de97bde0e2e7eb6de64ef1c8370f5c6e4283874b34cce46914d4
nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm
SHA-256: d2fd8d3242cc76d52c1eb84fced4f82b629cce882854ec7189f4de1ea47e20b4
npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.s390x.rpm
SHA-256: cb15472ea99a25a5ef7a58230666fa0e2a282529847bb9f0c3c0683371ea329a
Red Hat Enterprise Linux for Power, little endian 8
SRPM
nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.src.rpm
SHA-256: 983e8775d63de0440de6ff6ed9a17f869fefc74e71a3634c105c25cd965faca4
nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.src.rpm
SHA-256: 927e3c4afd119d0230c9293cfa166923c810dd02627edfd89087249fd0e06ad9
nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm
SHA-256: f1345ed8ecd3230b52424cb789ff10664a96a3e7eac42f3cc5c5e787e4d393bd
ppc64le
nodejs-docs-18.9.1-1.module+el8.7.0+16806+4109802b.noarch.rpm
SHA-256: fc37314a778494e8d56b7da10e411947d767bf75edb3e6dbe8c7cc7ce105e0d3
nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.noarch.rpm
SHA-256: dad46c4f4c3ca4a396c259e47e87df72fdad1d4b2009f469b4e7521d1e1f2583
nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm
SHA-256: 3ef698eb2f19de97bde0e2e7eb6de64ef1c8370f5c6e4283874b34cce46914d4
nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm
SHA-256: d2fd8d3242cc76d52c1eb84fced4f82b629cce882854ec7189f4de1ea47e20b4
nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm
SHA-256: fb96cb72b96b8edbbe1c80d323b9d4a7cdb7a06b18ff7ea30a4801ff25173c4b
nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm
SHA-256: 97200a26c455a0b01402f8287c23d9c10dccb598d98a4c0c9b576b7f74bcd32e
nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm
SHA-256: 6730519cbbac73829fe78d09d8b4f0ffbcdb164f757628c4932f17189d4621b5
nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm
SHA-256: 6f839f42548e051908defc042d7af11a96dc524b9e325672f013acdfff716d78
nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm
SHA-256: e2925bb43af1c0a7acbc7b1edc0bee8ad69dd703eac8332a024b52ce04a6e6b2
npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.ppc64le.rpm
SHA-256: 468292ef72e567e99a9cc8c6f018cfb46d3299dff5ceb6fe5ec9afe21163fc15
Red Hat Enterprise Linux for ARM 64 8
SRPM
nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.src.rpm
SHA-256: 983e8775d63de0440de6ff6ed9a17f869fefc74e71a3634c105c25cd965faca4
nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.src.rpm
SHA-256: 927e3c4afd119d0230c9293cfa166923c810dd02627edfd89087249fd0e06ad9
nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm
SHA-256: f1345ed8ecd3230b52424cb789ff10664a96a3e7eac42f3cc5c5e787e4d393bd
aarch64
nodejs-docs-18.9.1-1.module+el8.7.0+16806+4109802b.noarch.rpm
SHA-256: fc37314a778494e8d56b7da10e411947d767bf75edb3e6dbe8c7cc7ce105e0d3
nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.noarch.rpm
SHA-256: dad46c4f4c3ca4a396c259e47e87df72fdad1d4b2009f469b4e7521d1e1f2583
nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm
SHA-256: 3ef698eb2f19de97bde0e2e7eb6de64ef1c8370f5c6e4283874b34cce46914d4
nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm
SHA-256: d2fd8d3242cc76d52c1eb84fced4f82b629cce882854ec7189f4de1ea47e20b4
nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm
SHA-256: 0d5d321270e99663b04c6c9d7eb4bf6f9ac7a19ec53c1f06d4ac7da41520f279
nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm
SHA-256: e0d89c8d788eb99342737f93191c4a131b47aa425a4abf08411b18757311581e
nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm
SHA-256: 6c3755bae7407cd7b7376f5ed10edf077f28012611d695d1dbf4e32fcf6fd19b
nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm
SHA-256: ec97622aaf95f7190c698d8b4a38465afd299b5cdfc2f6eda332f00f8e0c8f46
nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm
SHA-256: 696d2f2b33127bb15e37770966233520ea1751f3ad27a88785f77f8f0f64649a
npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.aarch64.rpm
SHA-256: cd1823b50e91532d2ae0b41cb90cbac381235ee1b8f9e6221b84030b31f57a0d
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
Gentoo Linux Security Advisory 202405-29 - Multiple vulnerabilities have been discovered in Node.js. Versions greater than or equal to 16.20.2 are affected.
Ubuntu Security Notice 6491-1 - Axel Chong discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. Zeyu Zhang discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS.
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-35065: A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability. * CVE-2021-44531: A flaw was found in node.js where it accepted a certificate's Subject Alternative Names (SAN) entry...
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-35065: A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability. * CVE-2021-44906: An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to tr...
Debian Linux Security Advisory 5326-1 - Multiple vulnerabilities were discovered in Node.js, which could result in HTTP request smuggling, bypass of host IP address validation and weak randomness setup.
An update for nodejs and nodejs-nodemon is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-44906: minimist: prototype pollution * CVE-2022-3517: nodejs-minimatch: ReDoS via the braceExpand function * CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields * CVE-2022-43548: nodejs: DNS rebinding in inspect via invalid octal IP address
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published four Industrial Control Systems (ICS) advisories, calling out several security flaws affecting products from Siemens, GE Digital, and Contec. The most critical of the issues have been identified in Siemens SINEC INS that could lead to remote code execution via a path traversal flaw (CVE-2022-45092, CVSS score: 9.9)
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
Red Hat Security Advisory 2022-7830-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include HTTP request smuggling and bypass vulnerabilities.
Red Hat Security Advisory 2022-7821-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a HTTP request smuggling vulnerability.
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-44531: nodejs: Improper handling of URI Subject Alternative Names * CVE-2021-44532: nodejs: Certificate Verification Bypass via String Injection * CVE-2021-44533: nodejs: Incorrect handling of certificate subject and issuer fields * CVE-2022-21824: nodejs: Prototype pollution via console.table properties * CVE-2022-35256: nodejs: HTTP Reque...
Red Hat Security Advisory 2022-7044-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include HTTP request smuggling and bypass vulnerabilities.
An update for rh-nodejs14-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-44531: nodejs: Improper handling of URI Subject Alternative Names * CVE-2021-44532: nodejs: Certificate Verification Bypass via String Injection * CVE-2021-44533: nodejs: Incorrect handling of certificate subject and issuer fields * CVE-2021-44906: minimist: prototype pollution * CVE-2022-21824: nodejs: Prototype pollution via console.table...
Red Hat Security Advisory 2022-6963-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a HTTP request smuggling vulnerability.
Red Hat Security Advisory 2022-6963-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a HTTP request smuggling vulnerability.
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Red Hat Security Advisory 2022-6964-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a HTTP request smuggling vulnerability.
Red Hat Security Advisory 2022-6964-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a HTTP request smuggling vulnerability.
An update for nodejs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-35255: nodejs: weak randomness in WebCrypto keygen * CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields
An update for nodejs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-35255: nodejs: weak randomness in WebCrypto keygen * CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields
An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-35255: nodejs: weak randomness in WebCrypto keygen * CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields
An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-35255: nodejs: weak randomness in WebCrypto keygen * CVE-2022-35256: nodejs: HTTP Request Smuggling due to incorrect parsing of header fields