Headline

RHSA-2023:4536: Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2023-30581: No description is available for this CVE.
CVE-2023-30588: No description is available for this CVE.
CVE-2023-30589: The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVE-2023-30590: No description is available for this CVE.

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #nodejs #js #java #ibm #sap

Synopsis

Moderate: nodejs:18 security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (18.16.1). (BZ#2223630, BZ#2223631, BZ#2223632, BZ#2223633, BZ#2223635, BZ#2223642)

Security Fix(es):

nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:18/nodejs: Don’t assume FIPS is disabled by default [rhel-8] (BZ#2223639)

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
Red Hat Enterprise Linux Server - TUS 8.8 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

BZ - 2219824 - CVE-2023-30581 nodejs: mainModule.proto bypass experimental policy mechanism
BZ - 2219838 - CVE-2023-30588 nodejs: process interuption due to invalid Public Key information in x509 certificates
BZ - 2219841 - CVE-2023-30589 nodejs: HTTP Request Smuggling via Empty headers separated by CR
BZ - 2219842 - CVE-2023-30590 nodejs: DiffieHellman do not generate keys after setting a private key
BZ - 2223630 - nodejs:18/nodejs: Rebase to the latest Nodejs 18 release [rhel-8] [rhel-8.8.0.z]
BZ - 2223642 - nodejs:18/nodejs: Remove /usr/etc/npmrc softlink. [rhel-8] [rhel-8.8.0.z]

CVEs

CVE-2023-30581
CVE-2023-30588
CVE-2023-30589
CVE-2023-30590

Red Hat Enterprise Linux for x86_64 8

SRPM

nodejs-18.16.1-1.module+el8.8.0+19438+94e84959.src.rpm

SHA-256: b0eaafdfd4dc4af67ac9c8c340675ccbff2e9475f018267ab9ca6a34ab2e36da

nodejs-nodemon-2.0.20-2.module+el8.8.0+18432+27f188ac.src.rpm

SHA-256: 0631264b9ceb4ca04277265d9e12bdab3ddcd1fdad04ca458b8cfefc794d6a06

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm

SHA-256: f1345ed8ecd3230b52424cb789ff10664a96a3e7eac42f3cc5c5e787e4d393bd

x86_64

nodejs-docs-18.16.1-1.module+el8.8.0+19438+94e84959.noarch.rpm

SHA-256: 85aeeb4b110761b29ddd34339cbcf3e83a2f6ca5fbb7343e4634dedc42d44154

nodejs-nodemon-2.0.20-2.module+el8.8.0+18432+27f188ac.noarch.rpm

SHA-256: fd6a6348fcaf8099d2968844b2b4596c4237356ecca340fef40d765a4a487860

nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: 3ef698eb2f19de97bde0e2e7eb6de64ef1c8370f5c6e4283874b34cce46914d4

nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm

SHA-256: d2fd8d3242cc76d52c1eb84fced4f82b629cce882854ec7189f4de1ea47e20b4

nodejs-18.16.1-1.module+el8.8.0+19438+94e84959.x86_64.rpm

SHA-256: 710c02896445d95ea8fd36548cd8dc4fe1ec673d75728a42e568b6a026e0c4cd

nodejs-debuginfo-18.16.1-1.module+el8.8.0+19438+94e84959.x86_64.rpm

SHA-256: 8c98b5e6f1083ffaf165cc84bc2b474aa36e85fc2535d0db0d80683d439ba86f

nodejs-debugsource-18.16.1-1.module+el8.8.0+19438+94e84959.x86_64.rpm

SHA-256: b23ba3c59163739b3cbae1927076002537ca9f7cec9afe86e7510513d696a13b

nodejs-devel-18.16.1-1.module+el8.8.0+19438+94e84959.x86_64.rpm

SHA-256: cc4d7c1ef6dcf6111cda75764e5514439ee38a493fb56b6f736687bf88989ff1

nodejs-full-i18n-18.16.1-1.module+el8.8.0+19438+94e84959.x86_64.rpm

SHA-256: ba420e5c543423fa4f14569301bb68c3842618ab7727f8d750a19e10dc89cd47

npm-9.5.1-1.18.16.1.1.module+el8.8.0+19438+94e84959.x86_64.rpm

SHA-256: 3b982aead84ac235389459898467a9c52e49d812d6c1d5b11905951c4d2e5490

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8