Red Hat Security Advisory

RHSA-2023:5532

nodejs security and bug fix update

Released 2023-10-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.20.2-1.el9_2, nodejs-docs-1:16.20.2-1.el9_2, nodejs-full-i18n-1:16.20.2-1.el9_2 +2

Fixes 3 records

TI-2023-15309 CVE-2023-32002 · GHSA-9m48-r3w4-x35v

Authentication bypass in NodeJS Node

MEDIUM 52

The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0161 Published 2023-08-21 Fixed in 16.20.2, 18.17.1 +1 CWE-288

TI-2023-15313 CVE-2023-32006 · GHSA-356r-x8g9-vh8c

Protection mechanism failure in NodeJS Node

MEDIUM 43

The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01544 Published 2023-08-15 Fixed in 16.20.2, 18.17.1 +1 CWE-693

TI-2023-15841 CVE-2023-32559 · GHSA-g467-j8jp-rq97

Improper privilege management in NodeJS Node

LOW 38

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.018 Published 2023-08-24 Fixed in 16.20.2, 18.17.1 +1 CWE-269