Red Hat Security AdvisoryRHSA-2022:9073
nodejs:16 security, bug fix, and enhancement update
Released 2022-12-15 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64::nodejs:16, nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le::nodejs:16, nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x::nodejs:16 +19
Fixes 7 records
Priority MEDIUM 56
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04581 · Published 2022-03-17 · Partial fix · 1.2.6, 0.2.4 CWE-1321
Priority MEDIUM 55
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.21514 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-471
Priority MEDIUM 53
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.14839 · Published 2022-12-05 · Fixed in 14.21.1, 16.18.1 +2 CWE-78
Priority MEDIUM 43
A vulnerability was found in the minimatch package.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02279 · Published 2022-10-17 · Partial fix · 3.0.5 CWE-400
Priority MEDIUM 43
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.08373 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-295
Priority MEDIUM 42
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.09358 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-295
Priority LOW 37
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.10364 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-296
THREATIST.IORead the docs