Red Hat Security AdvisoryRHSA-2022:7830
nodejs:14 security update
Released 2022-11-08 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64::nodejs:14, nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le::nodejs:14, nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x::nodejs:14 +19
Fixes 5 records
Priority HIGH 68
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02764 · Published 2022-12-05 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority MEDIUM 55
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.21514 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-471
Priority MEDIUM 43
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.08373 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-295
Priority MEDIUM 42
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.09358 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-295
Priority LOW 37
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.10364 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-296
THREATIST.IORead the docs