Headline

RHSA-2023:3577: Red Hat Security Advisory: nodejs:18 security update

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2023-31124: c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.
CVE-2023-31130: c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular “0::00:00:00/2” was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.
CVE-2023-31147: c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.
CVE-2023-32067: c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #android #linux #red_hat #dos #nodejs #js #ibm #sap

Red Hat Enterprise Linux for x86_64 9

SRPM

nodejs-18.14.2-3.module+el9.2.0.z+18964+42696395.src.rpm

SHA-256: 206b02f0a4c75238b2ad535717b1c0809aa68c722e25a8f8c951fa66e2ce9e6a

nodejs-nodemon-2.0.20-2.module+el9.2.0.z+18497+a402347c.src.rpm

SHA-256: f42eebe45b0c22cb65f85b27b479549c77cd440a31691424666df533c698a663

nodejs-packaging-2021.06-4.module+el9.1.0+15718+e52ec601.src.rpm

SHA-256: fd4cb1826d0e63749d7ca229842c4449088dc3d7c3e3fb0704d722c66d20aff1

x86_64

nodejs-docs-18.14.2-3.module+el9.2.0.z+18964+42696395.noarch.rpm

SHA-256: 3ce5793e2a2473586674887ba9fcf94b48b21c58b2c20dfefbeccac46e58f6ed

nodejs-nodemon-2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch.rpm

SHA-256: c03444dc53c6326a1e94064ad0b1f2ec4d8bd8bb8ceacd48e1dd8337f9ad5340

nodejs-packaging-2021.06-4.module+el9.1.0+15718+e52ec601.noarch.rpm

SHA-256: 68464b58e953276d3e4ec6478cc7cd656b0bb7692b6232baeb53177a0dfc162d

nodejs-packaging-bundler-2021.06-4.module+el9.1.0+15718+e52ec601.noarch.rpm

SHA-256: b35bba697b10222e6e87e817a7feabe5802805e1c05fbbcf3d312dc532836b43

nodejs-18.14.2-3.module+el9.2.0.z+18964+42696395.x86_64.rpm

SHA-256: a1e84997eba026cb6403f9bed168c6c085d460ce12ae8ddc3a54b4fd8823a63b

nodejs-debuginfo-18.14.2-3.module+el9.2.0.z+18964+42696395.x86_64.rpm

SHA-256: e92b54c90316ca23b003a260478a40b8ec5cf7ea6c41115b0b8789d1cd37c955

nodejs-debugsource-18.14.2-3.module+el9.2.0.z+18964+42696395.x86_64.rpm

SHA-256: 4a7fbf8846cf91d243d2357ca6e96b6c19e95300290a6565db0e682674ec10e5

nodejs-devel-18.14.2-3.module+el9.2.0.z+18964+42696395.x86_64.rpm

SHA-256: 96930d1e24800f2e5519b6325556f743c74fccd57ab06e8cb00f9395a1192877

nodejs-full-i18n-18.14.2-3.module+el9.2.0.z+18964+42696395.x86_64.rpm

SHA-256: c6465fd9e712c117f70ea719393b29ad4d091e6463b2643d3da6c99d5b4d21dc

npm-9.5.0-1.18.14.2.3.module+el9.2.0.z+18964+42696395.x86_64.rpm

SHA-256: 273af9d6b924a6893e41ea12d9e56cf1733c297bb666efe42d8893b21f77f5b4

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2