Headline

RHSA-2022:0246: Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2020-7788: nodejs-ini: Prototype pollution via malicious INI file
CVE-2020-28469: nodejs-glob-parent: Regular expression denial of service
CVE-2021-3807: nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes
CVE-2021-3918: nodejs-json-schema: Prototype pollution vulnerability
CVE-2021-22959: llhttp: HTTP Request Smuggling due to spaces in headers
CVE-2021-22960: llhttp: HTTP Request Smuggling when parsing the body of chunked requests
CVE-2021-33502: normalize-url: ReDoS for data URLs
CVE-2021-37701: nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite
CVE-2021-37712: nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #nodejs #js #java

Synopsis

Moderate: nodejs:14 security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027608)

Security Fix(es):

nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)
nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
normalize-url: ReDoS for data URLs (CVE-2021-33502)
nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)
nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)
llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)
llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
Red Hat Enterprise Linux Server - AUS 8.4 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
Red Hat Enterprise Linux Server - TUS 8.4 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.4 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.4 x86_64

Fixes

BZ - 1907444 - CVE-2020-7788 nodejs-ini: Prototype pollution via malicious INI file
BZ - 1945459 - CVE-2020-28469 nodejs-glob-parent: Regular expression denial of service
BZ - 1964461 - CVE-2021-33502 normalize-url: ReDoS for data URLs
BZ - 1999731 - CVE-2021-37701 nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite
BZ - 1999739 - CVE-2021-37712 nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite
BZ - 2007557 - CVE-2021-3807 nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes
BZ - 2014057 - CVE-2021-22959 llhttp: HTTP Request Smuggling due to spaces in headers
BZ - 2014059 - CVE-2021-22960 llhttp: HTTP Request Smuggling when parsing the body of chunked requests
BZ - 2024702 - CVE-2021-3918 nodejs-json-schema: Prototype pollution vulnerability

CVEs

CVE-2020-7788
CVE-2020-28469
CVE-2021-3807
CVE-2021-3918
CVE-2021-22959
CVE-2021-22960
CVE-2021-33502
CVE-2021-37701
CVE-2021-37712

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM

nodejs-14.18.2-2.module+el8.4.0+13643+6c0ebf22.src.rpm

SHA-256: e636a959bcd6fdd314a79d6b389b795bf3ae231c43e60a91b5b595a00e2f56d2

nodejs-nodemon-2.0.15-1.module+el8.4.0+13503+fc29810b.src.rpm

SHA-256: 5f2cb075050566d6376e1eed54b1e94deeb2736ccd34e0ffd4421250faa75260

nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.src.rpm

SHA-256: 550d2f0197e4e69e9cfba813170d0fab3911749327f0c30db022424702287709

x86_64

nodejs-docs-14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch.rpm

SHA-256: 6a8a7d909f3b60d771ad27687d2c20337261cd61a9387e8b399f3b53c043ee51

nodejs-nodemon-2.0.15-1.module+el8.4.0+13503+fc29810b.noarch.rpm

SHA-256: dddc6659b69eedc3cf5c04910ee3087ffed60cdcfcf0ba1bbca5e48ef4686942

nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.noarch.rpm

SHA-256: d0ffb55491051b33ed7a0c9d1dfeb65ef76f367c9df1065140d0fa830091b169

nodejs-14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64.rpm

SHA-256: 40d20227632592691200ef49545ddfe280b0674d30335b81e763fcf873efccde

nodejs-debuginfo-14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64.rpm

SHA-256: a0f549fe3ee92da2d0ad0ec229c550c5b440e29329636543819bbc70e34cfe84

nodejs-debugsource-14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64.rpm

SHA-256: 4d781f6f7bfc8dff38cdc1a49c89378dfc717c32ecaa1167d59e76ebefd1b618

nodejs-devel-14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64.rpm

SHA-256: 482c7fcaf17a4a8a59ea4f02155b42533e689fa6f8d7f9474e7f89465fb8504a

nodejs-full-i18n-14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64.rpm

SHA-256: b3027228f8adac3a1d731191fe358aa93b97d3ff1c92c6500789f52a57b666de

npm-6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64.rpm

SHA-256: 640f7d9079a64f88bd831a330a0b787aab47c63c8c36f72538b8a01459080c45

Red Hat Enterprise Linux Server - AUS 8.4