Headline

RHSA-2023:4034: Red Hat Security Advisory: nodejs:16 security update

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2023-31124: A flaw was found in c-ares. This issue occurs when cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross-compiling aarch64 android. As a result, it will downgrade to rand(), which could allow an attacker to utilize the lack of entropy by not using a CSPRNG.
CVE-2023-31130: A vulnerability was found in c-ares. This issue occurs in the ares_inet_net_pton() function, which is vulnerable to a buffer underflow for certain ipv6 addresses. “0::00:00:00/2” in particular was found to cause an issue. C-ares only uses this function internally for configuration purposes, which would require an administrator to configure such an address via ares_set_sortlist().
CVE-2023-31147: A vulnerability was found in c-ares. This issue occurs when /dev/urandom or RtlGenRandom() are unavailable, c-ares will use rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand(), so it will generate predictable output.
CVE-2023-32067: A vulnerability was found in c-ares. This issue occurs due to a 0-byte UDP payload that can cause a Denial of Service.

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #android #linux #red_hat #dos #nodejs #js #java #ibm #sap

Synopsis

Important: nodejs:16 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
Red Hat Enterprise Linux Server - TUS 8.8 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

BZ - 2209494 - CVE-2023-31124 c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation
BZ - 2209497 - CVE-2023-31130 c-ares: Buffer Underwrite in ares_inet_net_pton()
BZ - 2209501 - CVE-2023-31147 c-ares: Insufficient randomness in generation of DNS query IDs
BZ - 2209502 - CVE-2023-32067 c-ares: 0-byte UDP payload Denial of Service

CVEs

CVE-2023-31124
CVE-2023-31130
CVE-2023-31147
CVE-2023-32067

Red Hat Enterprise Linux for x86_64 8

SRPM

nodejs-16.19.1-2.module+el8.8.0+19038+6f60344f.src.rpm

SHA-256: a76a67f2a0e7aa7854262cfa3d82804f289bd55a381e13308fa8c85d1e582748

nodejs-nodemon-2.0.20-3.module+el8.8.0+19038+6f60344f.src.rpm

SHA-256: 46124aea68099f2271bfc5470c1f5df43bc7ee2344b5cc26d46236b2ffba8161

nodejs-packaging-25-1.module+el8.5.0+10992+fac5fe06.src.rpm

SHA-256: 33ac4142978ab66debe87d4af95fd56ed6a39f0947eb46a6ca988dc7d035a835

x86_64

nodejs-16.19.1-2.module+el8.8.0+19038+6f60344f.x86_64.rpm

SHA-256: 93430cc0c9bd8da74bb51ead89d845746ff7598aee7bdebe81c287e2689e4e56

nodejs-debuginfo-16.19.1-2.module+el8.8.0+19038+6f60344f.x86_64.rpm

SHA-256: 24b6818f5ec0d7937a215269347d4327571cfc19160472b1b932889092f9454f

nodejs-debugsource-16.19.1-2.module+el8.8.0+19038+6f60344f.x86_64.rpm

SHA-256: 5003ab5b06d2d19b8d6bbc014c794c6822d0f312b17542dc975f42b171f4f258

nodejs-devel-16.19.1-2.module+el8.8.0+19038+6f60344f.x86_64.rpm

SHA-256: f24280d11478ab7afecab43b3c764d8e6b16e6f63b63089c77a922bbb923c842

nodejs-docs-16.19.1-2.module+el8.8.0+19038+6f60344f.noarch.rpm

SHA-256: 387df3c1263c2323bcb3831771aa21591ce63ceb6dad6a8ea2bb480cfd13f85f

nodejs-full-i18n-16.19.1-2.module+el8.8.0+19038+6f60344f.x86_64.rpm

SHA-256: 5329edbba9eb35fbb52775f6e953a4de38784f46a357102524f6cee9a3dda96e

nodejs-nodemon-2.0.20-3.module+el8.8.0+19038+6f60344f.noarch.rpm

SHA-256: ff0844eb3b77b43bde310cac1f8a5cfcea3770f2b1fc59f4179f962aba51cd0a

nodejs-packaging-25-1.module+el8.5.0+10992+fac5fe06.noarch.rpm

SHA-256: f39eef40249724ab490a024922470273a1c4789881bc489aaa719a432380edfc

npm-8.19.3-1.16.19.1.2.module+el8.8.0+19038+6f60344f.x86_64.rpm

SHA-256: 0b10b30281b70a3e27a591000b49979bbe74fc36d5745c24766b652c0bae8089

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8