Red Hat Security AdvisoryRHSA-2023:5360
nodejs:16 security, bug fix, and enhancement update
Released 2023-09-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64::nodejs:16, nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le::nodejs:16, nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x::nodejs:16 +19
Fixes 4 records
Priority HIGH 72
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02761 · Published 2023-06-21 · Partial fix · 7.5.2, 6.3.1 +1 CWE-1333
Priority MEDIUM 52
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0161 · Published 2023-08-21 · Fixed in 16.20.2, 18.17.1 +1 CWE-288
Priority MEDIUM 43
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01544 · Published 2023-08-15 · Fixed in 16.20.2, 18.17.1 +1 CWE-693
Priority LOW 38
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.018 · Published 2023-08-24 · Fixed in 16.20.2, 18.17.1 +1 CWE-269
THREATIST.IORead the docs