Red Hat Security Advisory

RHSA-2023:7205

nodejs:20 security update

Released 2023-11-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.aarch64::nodejs:20, nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.ppc64le::nodejs:20, nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.s390x::nodejs:20 +20

Fixes 6 records

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2023-20472 CVE-2023-39332 · GHSA-9hm3-chgj-45rm

Path traversal in NodeJS Node

MEDIUM 53

Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02185 Published 2023-10-18 Fixed in 20.8.1 CWE-22

TI-2023-19928 CVE-2023-38552 · GHSA-x39v-frq9-5hh8

Insufficient verification of data authenticity in NodeJS Node

MEDIUM 41

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectivel…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01236 Published 2023-10-18 Partial fix · 18.18.2, 20.8.1 CWE-345

TI-2023-20471 CVE-2023-39331 · GHSA-7xrv-q25v-f95m

Path traversal in NodeJS Node

LOW 38

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01508 Published 2023-10-18 Fixed in 20.8.1 CWE-22

TI-2023-20473 CVE-2023-39333 · GHSA-wj24-gwh6-mgh8

Code injection in NodeJS Node

LOW 32

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01107 Published 2024-09-07 Partial fix · 18.18.2, 20.8.1 CWE-94

TI-2023-24164 CVE-2023-45143 · GHSA-wqq4-5wpv-mx2g

Undici's cookie header not cleared on cross-origin redirect in fetch

LOW 21

Undici is an HTTP/1.1 client written from scratch for Node.js.

CVSS 3.1LOW 3.9 Network High privileges User interaction EPSS 0.01368 Published 2023-10-12 Partial fix · 5.26.2 CWE-200