Headline

RHSA-2023:5363: Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2022-25883: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the ‘new Range’ function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.
CVE-2023-32002: A vulnerability was found in NodeJS. This security issue occurs as the use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
CVE-2023-32006: A vulnerability was found in NodeJS. This security issue occurs as the use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
CVE-2023-32559: A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding(‘spawn_sync’) to run arbitrary code outside of the limits defined in a policy.json file.

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #nodejs #js #ibm #sap

Red Hat Enterprise Linux for x86_64 9

SRPM

nodejs-18.17.1-1.module+el9.2.0.z+19753+58118bc0.src.rpm

SHA-256: abe0e997ed5cf7d5fd4078e803e65fc6d26545e072d51a2b2c1c2e2716947f23

nodejs-nodemon-3.0.1-1.module+el9.2.0.z+19753+58118bc0.src.rpm

SHA-256: 1e0049339a219e9b3ba5efdbfd72f17588579ae7261f2b49a6a70fdcdc77c817

nodejs-packaging-2021.06-4.module+el9.1.0+15718+e52ec601.src.rpm

SHA-256: fd4cb1826d0e63749d7ca229842c4449088dc3d7c3e3fb0704d722c66d20aff1

x86_64

nodejs-docs-18.17.1-1.module+el9.2.0.z+19753+58118bc0.noarch.rpm

SHA-256: ffc4730b236dc8135d030fbb36d024cbfc429e7b7eb88144e932ca4353792c38

nodejs-nodemon-3.0.1-1.module+el9.2.0.z+19753+58118bc0.noarch.rpm

SHA-256: 983a121af46cdd17154e17ee52eae127e0b253edab556d116539b3c7f74df20a

nodejs-packaging-2021.06-4.module+el9.1.0+15718+e52ec601.noarch.rpm

SHA-256: 68464b58e953276d3e4ec6478cc7cd656b0bb7692b6232baeb53177a0dfc162d

nodejs-packaging-bundler-2021.06-4.module+el9.1.0+15718+e52ec601.noarch.rpm

SHA-256: b35bba697b10222e6e87e817a7feabe5802805e1c05fbbcf3d312dc532836b43

nodejs-18.17.1-1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm

SHA-256: e0c72519a8ec13fe45edd9bcaea8f402b2d50026384941092fd1334ac3bfc897

nodejs-debuginfo-18.17.1-1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm

SHA-256: 52fef130788ff58416b7e90caaedfd49ab930b967188f49e26be6febbca45333

nodejs-debugsource-18.17.1-1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm

SHA-256: a93cbe523db396ca1e1d599341609ac0aa163a22565f30ae1f480108f5519001

nodejs-devel-18.17.1-1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm

SHA-256: 0407e6ff8a9978ef55c261efe19d4d9a2ff5a84aabd7b145c5c85e200430f451

nodejs-full-i18n-18.17.1-1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm

SHA-256: 16afd4d92d14684d02ffd6f1e2fca53a9add45caaded0713feb550c14de043ef

npm-9.6.7-1.18.17.1.1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm

SHA-256: a268f0368a5b3586e14f6c7d3a8227ef193e8fad40c1e21c126275259cda789b

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2