Headline

RHSA-2023:4537: Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2023-30581: No description is available for this CVE.
CVE-2023-30588: No description is available for this CVE.
CVE-2023-30589: The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVE-2023-30590: No description is available for this CVE.

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #nodejs #js #java #ibm #sap

Synopsis

Moderate: nodejs:16 security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (16.20.1). (BZ#2223678, BZ#2223680, BZ#2223682, BZ#2223684, BZ#2223686, BZ#2223688)

Security Fix(es):

nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
Red Hat Enterprise Linux Server - TUS 8.8 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

BZ - 2219824 - CVE-2023-30581 nodejs: mainModule.proto bypass experimental policy mechanism
BZ - 2219838 - CVE-2023-30588 nodejs: process interuption due to invalid Public Key information in x509 certificates
BZ - 2219841 - CVE-2023-30589 nodejs: HTTP Request Smuggling via Empty headers separated by CR
BZ - 2219842 - CVE-2023-30590 nodejs: DiffieHellman do not generate keys after setting a private key
BZ - 2223678 - nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [rhel-8] [rhel-8.8.0.z]
BZ - 2223688 - nodejs:16/nodejs: Remove /usr/etc/npmrc softlink. [rhel-8] [rhel-8.8.0.z]

CVEs

CVE-2023-30581
CVE-2023-30588
CVE-2023-30589
CVE-2023-30590

Red Hat Enterprise Linux for x86_64 8

SRPM

nodejs-16.20.1-1.module+el8.8.0+19440+ee8dbee5.src.rpm

SHA-256: 3a9877c58d25e1a4e2e5a4b28aee27425f7d28cc849468e086fcd970f187115f

nodejs-nodemon-2.0.20-3.module+el8.8.0+19038+6f60344f.src.rpm

SHA-256: 46124aea68099f2271bfc5470c1f5df43bc7ee2344b5cc26d46236b2ffba8161

nodejs-packaging-25-1.module+el8.5.0+10992+fac5fe06.src.rpm

SHA-256: 33ac4142978ab66debe87d4af95fd56ed6a39f0947eb46a6ca988dc7d035a835

x86_64

nodejs-docs-16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch.rpm

SHA-256: f28c28af61ef648ddd43b0304b8a46a7b9b8401e0e88002e20781980c0a306d8

nodejs-nodemon-2.0.20-3.module+el8.8.0+19038+6f60344f.noarch.rpm

SHA-256: ff0844eb3b77b43bde310cac1f8a5cfcea3770f2b1fc59f4179f962aba51cd0a

nodejs-packaging-25-1.module+el8.5.0+10992+fac5fe06.noarch.rpm

SHA-256: f39eef40249724ab490a024922470273a1c4789881bc489aaa719a432380edfc

nodejs-16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64.rpm

SHA-256: e9e79bda8b1d386244f2589455e25e31c7dc493d1619350e45eabe06d06edb13

nodejs-debuginfo-16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64.rpm

SHA-256: 9561d2b9e83960a268fa4732f7343f8ba19ae4eaecf58686227790e844095f40

nodejs-debugsource-16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64.rpm

SHA-256: c7cffed54df160651e87d6866e17f2bfd07a73303439e111c9da07e0101403b8

nodejs-devel-16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64.rpm

SHA-256: 882948bcac62e63a12dd096f09bc7d78781f46b121ab32b5d1ddb5df2f3cf7e7

nodejs-full-i18n-16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64.rpm

SHA-256: 0380f42fc31e820c4ebbae6ce40fae00e4fe7036dac9a1d2f9f27f7c0a22e936

npm-8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64.rpm

SHA-256: 8e2e1334071916a6e169970669b43e0be6dd5e7fd82dd3d9d874a2045dcb0811

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8