Headline

RHSA-2023:5362: Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2022-25883: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the ‘new Range’ function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.
CVE-2023-32002: A vulnerability was found in NodeJS. This security issue occurs as the use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
CVE-2023-32006: A vulnerability was found in NodeJS. This security issue occurs as the use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
CVE-2023-32559: A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding(‘spawn_sync’) to run arbitrary code outside of the limits defined in a policy.json file.

11 months ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #nodejs #js #java #ibm #sap

Synopsis

Important: nodejs:18 security, bug fix, and enhancement update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2234409)

Security Fix(es):

nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)
nodejs-semver: Regular expression denial of service (CVE-2022-25883)
nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006)
nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
Red Hat Enterprise Linux Server - TUS 8.8 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

BZ - 2216475 - CVE-2022-25883 nodejs-semver: Regular expression denial of service
BZ - 2230948 - CVE-2023-32002 nodejs: Permissions policies can be bypassed via Module._load
BZ - 2230955 - CVE-2023-32006 nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()
BZ - 2230956 - CVE-2023-32559 nodejs: Permissions policies can be bypassed via process.binding
BZ - 2234409 - nodejs:18/nodejs: Rebase to the latest Nodejs 18 release [rhel-8] [rhel-8.8.0.z]

CVEs

CVE-2022-25883
CVE-2023-32002
CVE-2023-32006
CVE-2023-32559

Red Hat Enterprise Linux for x86_64 8

SRPM

nodejs-18.17.1-1.module+el8.8.0+19757+8ca87034.src.rpm

SHA-256: dd907999987a2829def532b150bdc73e0a111488656e0f0584bd0ba71a489fa5

nodejs-nodemon-3.0.1-1.module+el8.8.0+19757+8ca87034.src.rpm

SHA-256: 4cbcbfa6f0fbee8f857317816fe19c6bc2d7f6759e9acbe6648f0dcf56086526

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm

SHA-256: f1345ed8ecd3230b52424cb789ff10664a96a3e7eac42f3cc5c5e787e4d393bd

x86_64

nodejs-18.17.1-1.module+el8.8.0+19757+8ca87034.x86_64.rpm

SHA-256: e7c408fc4e584548253611fa8fc699e7bb4f4c98f172a40183c117c8586ab7fc

nodejs-debuginfo-18.17.1-1.module+el8.8.0+19757+8ca87034.x86_64.rpm

SHA-256: 7aa808c96f2783d6dcc4d1c41417316220b6ba0bbd3011f6c85f8753980d568d

nodejs-debugsource-18.17.1-1.module+el8.8.0+19757+8ca87034.x86_64.rpm

SHA-256: a719542a212cf6f076f40a188e5e24642d94855f6e574ec31a43bbb689fd1132

nodejs-devel-18.17.1-1.module+el8.8.0+19757+8ca87034.x86_64.rpm

SHA-256: c20ec2d8f08fec2647f403b03026187309e329cb7fcd09264ab2ff843f6edc03

nodejs-docs-18.17.1-1.module+el8.8.0+19757+8ca87034.noarch.rpm

SHA-256: 87b1d1aa07b606240cac94453631399f422ecbc4470c9deb1ce9cce17da72287

nodejs-full-i18n-18.17.1-1.module+el8.8.0+19757+8ca87034.x86_64.rpm

SHA-256: 3ef133e9b8cbd1b8313050b6b5f18c4b0e3d7ff42d5d1147e851d9af20694b20

nodejs-nodemon-3.0.1-1.module+el8.8.0+19757+8ca87034.noarch.rpm

SHA-256: f83ae6914fb89c33cf84aad6f159ff9905b9b958a99758b64f112962954b870c

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: 3ef698eb2f19de97bde0e2e7eb6de64ef1c8370f5c6e4283874b34cce46914d4

nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: d2fd8d3242cc76d52c1eb84fced4f82b629cce882854ec7189f4de1ea47e20b4

npm-9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034.x86_64.rpm

SHA-256: fe6f98c6be20e71ac33333560bdd8807e84ccb216bdc098d449bc8b943a470dd

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8