Red Hat Security AdvisoryRHSA-2022:6448
nodejs:14 security and bug fix update
Released 2022-09-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.20.0-2.module+el8.6.0+16231+7c1b33d9.aarch64::nodejs:14, nodejs-1:14.20.0-2.module+el8.6.0+16231+7c1b33d9.ppc64le::nodejs:14, nodejs-1:14.20.0-2.module+el8.6.0+16231+7c1b33d9.s390x::nodejs:14 +19
Fixes 5 records
Priority HIGH 69
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.81832 · Published 2022-07-14 · Fixed in 14.20.0, 16.20.0 +2 CWE-444
Priority HIGH 66
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.70244 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority MEDIUM 58
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.44843 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +2 CWE-444
Priority MEDIUM 45
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP addr…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.06432 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +1 CWE-284
Priority LOW 29
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02416 · Published 2022-06-18 · Partial fix · 12.1.0, 11.8.5
THREATIST.IORead the docs