Red Hat Security AdvisoryRHSA-2023:4536
nodejs:18 security, bug fix, and enhancement update
Released 2023-08-08 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.16.1-1.module+el8.8.0+19438+94e84959.aarch64::nodejs:18, nodejs-1:18.16.1-1.module+el8.8.0+19438+94e84959.ppc64le::nodejs:18, nodejs-1:18.16.1-1.module+el8.8.0+19438+94e84959.s390x::nodejs:18 +20
Fixes 4 records
Priority MEDIUM 45
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03906 · Published 2023-06-30 · Partial fix · 16.20.1, 18.16.1 +2
Priority MEDIUM 42
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01462 · Published 2023-11-28 · Partial fix · 16.20.1, 18.16.1 +1
Priority MEDIUM 41
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0105 · Published 2023-11-22 · Partial fix · 16.20.1, 18.16.1 +1 CWE-862
Priority LOW 26
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01157 · Published 2023-11-28 · Partial fix · 16.20.1, 18.16.1 +1
THREATIST.IORead the docs