Headline

RHSA-2023:2654: Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2021-35065: A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.
CVE-2022-4904: A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.
CVE-2022-25881: A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.
CVE-2023-23918: A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
CVE-2023-23919: A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
CVE-2023-23920: An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
CVE-2023-23936: A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the ‘host’ header. This issue could allow HTTP response splitting and HTTP header injection.
CVE-2023-24807: Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #nodejs #js #auth #ibm #sap #ssl

Red Hat Enterprise Linux for x86_64 9

SRPM

nodejs-18.14.2-2.module+el9.2.0.z+18497+a402347c.src.rpm

SHA-256: 65513cc2d6ab785ec20c1bf2bbc7b664af503ab3b4aaa4395841eeaab777ecaf

nodejs-nodemon-2.0.20-2.module+el9.2.0.z+18497+a402347c.src.rpm

SHA-256: f42eebe45b0c22cb65f85b27b479549c77cd440a31691424666df533c698a663

nodejs-packaging-2021.06-4.module+el9.1.0+15718+e52ec601.src.rpm

SHA-256: fd4cb1826d0e63749d7ca229842c4449088dc3d7c3e3fb0704d722c66d20aff1

x86_64

nodejs-docs-18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch.rpm

SHA-256: 2a91a597a4f915b8286d64ca06830b7d5a5ebecb94c3573f9620c27ba6a4a6e9

nodejs-nodemon-2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch.rpm

SHA-256: c03444dc53c6326a1e94064ad0b1f2ec4d8bd8bb8ceacd48e1dd8337f9ad5340

nodejs-packaging-2021.06-4.module+el9.1.0+15718+e52ec601.noarch.rpm

SHA-256: 68464b58e953276d3e4ec6478cc7cd656b0bb7692b6232baeb53177a0dfc162d

nodejs-packaging-bundler-2021.06-4.module+el9.1.0+15718+e52ec601.noarch.rpm

SHA-256: b35bba697b10222e6e87e817a7feabe5802805e1c05fbbcf3d312dc532836b43

nodejs-18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64.rpm

SHA-256: 64f015eceebbc3ad6087f0b00365e06da6341bd7ad5ec04d1f06ca107f9aa714

nodejs-debuginfo-18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64.rpm

SHA-256: ec6cef50e2d982b4c995948575bca537647ec84e8c982a7c160848ea6d58e27e

nodejs-debugsource-18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64.rpm

SHA-256: 98765da70563ef205f2e041c96730616daaa6b83782a4a5f28e5e0f8e7a8894b

nodejs-devel-18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64.rpm

SHA-256: 66383b2f682c629114b63ce6edf5d7cca563a3a11c4ef53941fa4153f5517fa5

nodejs-full-i18n-18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64.rpm

SHA-256: 7c7c1ef95776dafb84337abe882c2793f9b2490b4973551b60f0052e63eff0c4

npm-9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64.rpm

SHA-256: a634af3677f62946ca478dabc1f9500ebf508e3ecaa54eb6dea9e6946191ea08

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2