Red Hat Security AdvisoryRHSA-2023:0612
rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
Released 2023-02-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
- Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
Fixes 6 records
Priority HIGH 72
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.15695 · Published 2022-11-26 · Partial fix · 6.10.3, 6.9.7 +7 CWE-1321
Priority HIGH 66
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01696 · Published 2022-12-26 · Partial fix · 6.0.1 CWE-1333
Priority MEDIUM 56
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04581 · Published 2022-03-17 · Partial fix · 1.2.6, 0.2.4 CWE-1321
Priority MEDIUM 53
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.14839 · Published 2022-12-05 · Fixed in 14.21.1, 16.18.1 +2 CWE-78
Priority MEDIUM 43
A vulnerability was found in the minimatch package.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02279 · Published 2022-10-17 · Partial fix · 3.0.5 CWE-400
Priority LOW 31
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01653 · Published 2022-01-16 · Partial fix · 3.1.1, 2.6.7 CWE-200
THREATIST.IORead the docs