Red Hat Security AdvisoryRHSA-2023:1533
nodejs:14 security, bug fix, and enhancement update
Released 2023-03-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x::nodejs:14 +19
Fixes 11 records
Priority HIGH 72
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.15695 · Published 2022-11-26 · Partial fix · 6.10.3, 6.9.7 +7 CWE-1321
Priority HIGH 68
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02764 · Published 2022-12-05 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority HIGH 68
This affects versions of the package http-cache-semantics before 4.1.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01613 · Published 2023-01-31 · Partial fix · 4.1.1 CWE-1333
Priority HIGH 66
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.2361 · Published 2022-11-28 · Partial fix · 0.2.1 CWE-20
Priority HIGH 66
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01696 · Published 2022-12-26 · Partial fix · 6.0.1 CWE-1333
Priority MEDIUM 56
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04581 · Published 2022-03-17 · Partial fix · 1.2.6, 0.2.4 CWE-1321
Priority MEDIUM 53
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.14839 · Published 2022-12-05 · Fixed in 14.21.1, 16.18.1 +2 CWE-78
Priority MEDIUM 46
A flaw was found in the c-ares package.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01232 · Published 2023-03-06 · Partial fix CWE-20
Priority MEDIUM 43
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js an…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02023 · Published 2023-02-23 · Partial fix · 14.21.3, 16.19.1 +2 CWE-863
Priority MEDIUM 43
A vulnerability was found in the minimatch package.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02279 · Published 2022-10-17 · Partial fix · 3.0.5 CWE-400
Priority LOW 20
An untrusted search path vulnerability exists in Node.js.
CVSS 3.1MEDIUM 4.2· Local · High privileges · User interaction · EPSS 0.00452 · Published 2023-02-23 · Partial fix · 14.21.3, 16.19.1 +2 CWE-426
THREATIST.IORead the docs