Red Hat Security AdvisoryRHSA-2022:7821
nodejs:18 security update
Released 2022-11-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.9.1-1.module+el8.7.0+16806+4109802b.aarch64::nodejs:18, nodejs-1:18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le::nodejs:18, nodejs-1:18.9.1-1.module+el8.7.0+16806+4109802b.s390x::nodejs:18 +20
Fixes 2 records
Priority HIGH 68
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02764 · Published 2022-12-05 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority MEDIUM 51
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02091 · Published 2022-12-05 · Fixed in 18.9.1 CWE-338
