Red Hat Security Advisory

RHSA-2022:7044

rh-nodejs14-nodejs security update

Released 2022-10-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.20.1-2.el7, rh-nodejs14-nodejs-devel-14.20.1-2.el7, rh-nodejs14-nodejs-docs-14.20.1-2.el7 +1
Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.20.1-2.el7, rh-nodejs14-nodejs-devel-14.20.1-2.el7, rh-nodejs14-nodejs-docs-14.20.1-2.el7 +1

Fixes 6 records

TI-2022-15935 CVE-2022-35256 · GHSA-rc2m-q589-vpqx

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header…

HIGH 68

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02764 Published 2022-12-05 Fixed in 14.20.1, 16.17.1 +1 CWE-444

TI-2021-20323 CVE-2021-44906 · GHSA-xvch-5gv4-984h

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

MEDIUM 56

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04581 Published 2022-03-17 Partial fix · 1.2.6, 0.2.4 CWE-1321

TI-2022-06195 CVE-2022-21824 · GHSA-39wv-qjgj-4jxg

Prototype pollution in NodeJS Node

MEDIUM 55

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.21514 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-471

TI-2021-20131 CVE-2021-44531 · GHSA-5qpf-4xwh-5775

Improper certificate validation in NodeJS Node

MEDIUM 43

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.08373 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-295

TI-2021-20133 CVE-2021-44533

Improper certificate validation in NodeJS Node

MEDIUM 42

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.09358 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-295

TI-2021-20132 CVE-2021-44532 · GHSA-jg6g-8j59-vr29

Improper certificate validation in NodeJS Node

LOW 37

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.10364 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-296