Headline

RHSA-2023:5360: Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2022-25883: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the ‘new Range’ function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.
CVE-2023-32002: A vulnerability was found in NodeJS. This security issue occurs as the use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
CVE-2023-32006: A vulnerability was found in NodeJS. This security issue occurs as the use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
CVE-2023-32559: A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding(‘spawn_sync’) to run arbitrary code outside of the limits defined in a policy.json file.

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #nodejs #js #java #ibm #sap

Synopsis

Important: nodejs:16 security, bug fix, and enhancement update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16). (BZ#2233891)

Security Fix(es):

nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)
nodejs-semver: Regular expression denial of service (CVE-2022-25883)
nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006)
nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:16/nodejs: nodejs.prov doesn’t generate the bundled dependency for modules starting @ like @colors/colors (BZ#2237394)

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
Red Hat Enterprise Linux Server - TUS 8.8 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

BZ - 2216475 - CVE-2022-25883 nodejs-semver: Regular expression denial of service
BZ - 2230948 - CVE-2023-32002 nodejs: Permissions policies can be bypassed via Module._load
BZ - 2230955 - CVE-2023-32006 nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()
BZ - 2230956 - CVE-2023-32559 nodejs: Permissions policies can be bypassed via process.binding
BZ - 2233891 - nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [rhel-8] [rhel-8.8.0.z]
BZ - 2237394 - nodejs:16/nodejs: nodejs.prov doesn’t generate the bundled dependency for modules starting @ like @colors/colors [rhel-8.8.0.z]

CVEs

CVE-2022-25883
CVE-2023-32002
CVE-2023-32006
CVE-2023-32559

Red Hat Enterprise Linux for x86_64 8

SRPM

nodejs-16.20.2-2.module+el8.8.0+19898+ab99ba34.src.rpm

SHA-256: 78b580a854c4db0b962a7dddfefb5e474be0d289796666bb67a41bdecb9b8284

nodejs-nodemon-3.0.1-1.module+el8.8.0+19764+7eed1ca3.src.rpm

SHA-256: 1ebdeeae6ca30c544104124b1580cdf52905cbb6269972278de2d2207ce61d10

nodejs-packaging-26-1.module+el8.8.0+19857+6d2a104d.src.rpm

SHA-256: bdaf873380ef1e8cbba260408de061175ffdcb1954e05be0dbc220e1d1036f7c

x86_64

nodejs-docs-16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch.rpm

SHA-256: 547c21e9a8b3fa533a8ebf9b4fe8cd6f12519df5c32e89f2eafc7190cbfbdbcd

nodejs-nodemon-3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch.rpm

SHA-256: a7d7a59963cc746d52f470b2c7c8cc2f50b9abc684071aa205d4faff1e1c8522

nodejs-packaging-26-1.module+el8.8.0+19857+6d2a104d.noarch.rpm

SHA-256: bd77288c2950311aaf1582c74e408acbb765d9aca00f089f449649762de12bdb

nodejs-16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64.rpm

SHA-256: abdda9e6a63786e5eb352066010312c870c637069e20abfdf5f4c6c6646514d7

nodejs-debuginfo-16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64.rpm

SHA-256: 61ef121f3ef46ec460f733590d2c113550c60730db17a379ba3bdd13b6fbb27e

nodejs-debugsource-16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64.rpm

SHA-256: 6a8ef170fcefb7a66e19567ee4b3a1b0eaa9e9ec858eff263c09ed6f21af3733

nodejs-devel-16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64.rpm

SHA-256: ec2e87527d72461c9726bc9f645c31696a81f105baa2323e229ec5fb82bcbfea

nodejs-full-i18n-16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64.rpm

SHA-256: f54d055ddc7183496cc9a43464f615011c4e0e7a7e5c75a45f4c54f7385dbd02

npm-8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64.rpm

SHA-256: 9bcb31cd60f57fd8e5bcb14f0b41c79564d3cc5cbc1c19288fbc07472d70bf72

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8