Red Hat Security AdvisoryRHSA-2022:6964
nodejs:16 security update
Released 2022-10-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.17.1-1.module+el8.6.0+16848+a483195a.aarch64::nodejs:16, nodejs-1:16.17.1-1.module+el8.6.0+16848+a483195a.ppc64le::nodejs:16, nodejs-1:16.17.1-1.module+el8.6.0+16848+a483195a.s390x::nodejs:16 +19
Fixes 2 records
Priority HIGH 68
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02764 · Published 2022-12-05 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority MEDIUM 51
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02091 · Published 2022-12-05 · Fixed in 18.9.1 CWE-338
