Red Hat Security AdvisoryRHSA-2023:5849
nodejs:18 security update
Released 2023-10-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5.aarch64::nodejs:18, nodejs-1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5.ppc64le::nodejs:18, nodejs-1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5.s390x::nodejs:18 +20
Fixes 4 records
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority MEDIUM 41
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectivel…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01236 · Published 2023-10-18 · Partial fix · 18.18.2, 20.8.1 CWE-345
Priority LOW 32
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01107 · Published 2024-09-07 · Partial fix · 18.18.2, 20.8.1 CWE-94
Priority LOW 21
Undici is an HTTP/1.1 client written from scratch for Node.js.
CVSS 3.1LOW 3.9· Network · High privileges · User interaction · EPSS 0.01368 · Published 2023-10-12 · Partial fix · 5.26.2 CWE-200
