Red Hat Security Advisory

RHSA-2023:2654

nodejs:18 security, bug fix, and enhancement update

Released 2023-05-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18, nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18, nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18 +20

Fixes 8 records

TI-2023-09717 CVE-2023-23919 · GHSA-mfq6-mjjx-mp7f

Cryptographic flaw in NodeJS Node

HIGH 72

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02209 Published 2023-02-23 Partial fix · 14.21.3, 16.19.1 +2 CWE-310

TI-2023-09734 CVE-2023-23936 · GHSA-5r9g-qh6m-jxff

CRLF Injection in Nodejs ‘undici’ via host

HIGH 68

Undici is an HTTP/1.1 client for Node.js.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01129 Published 2023-02-16 Partial fix · 5.19.1 CWE-93

TI-2022-09440 CVE-2022-25881 · GHSA-rc47-6667-2j5j

Regular expression denial of service in http-cache-semantics

HIGH 68

This affects versions of the package http-cache-semantics before 4.1.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01613 Published 2023-01-31 Partial fix · 4.1.1 CWE-1333

TI-2021-14025 CVE-2021-35065 · GHSA-cj88-88mr-972w

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial…

HIGH 66

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01696 Published 2022-12-26 Partial fix · 6.0.1 CWE-1333

TI-2022-04495 CVE-2022-4904 · GHSA-v7h6-g695-5j7q

Improper input validation in c-ares

MEDIUM 46

A flaw was found in the c-ares package.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01232 Published 2023-03-06 Partial fix CWE-20

TI-2023-09716 CVE-2023-23918 · GHSA-33p5-m25c-cp6w

Incorrect authorization in NodeJS Node

MEDIUM 43

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js an…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02023 Published 2023-02-23 Partial fix · 14.21.3, 16.19.1 +2 CWE-863

TI-2023-10307 CVE-2023-24807 · GHSA-r6ch-mqf9-qc9w

Undici vulnerable to Regular Expression Denial of Service in Headers

MEDIUM 42

Undici is an HTTP/1.1 client for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01315 Published 2023-02-16 Partial fix · 5.19.1 CWE-20

TI-2023-09718 CVE-2023-23920 · GHSA-fj8r-46q3-hp4r

Untrusted search path in NodeJS Node

LOW 20

An untrusted search path vulnerability exists in Node.js.

CVSS 3.1MEDIUM 4.2 Local High privileges User interaction EPSS 0.00452 Published 2023-02-23 Partial fix · 14.21.3, 16.19.1 +2 CWE-426