Red Hat Security Advisory

RHSA-2022:8832

nodejs:18 security, bug fix, and enhancement update

Released 2022-12-06 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64::nodejs:18, nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le::nodejs:18, nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x::nodejs:18 +20

Fixes 2 records

TI-2022-21328 CVE-2022-43548 · GHSA-r934-m2c7-26gh

OS command injection in NodeJS Node

MEDIUM 53

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.14839 Published 2022-12-05 Fixed in 14.21.1, 16.18.1 +2 CWE-78

TI-2022-03245 CVE-2022-3517 · GHSA-f8q6-p94x-37v3

Uncontrolled resource consumption in minimatch

MEDIUM 43

A vulnerability was found in the minimatch package.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02279 Published 2022-10-17 Partial fix · 3.0.5 CWE-400