Red Hat Security Advisory

RHSA-2024:1880

nodejs:18 security update

Released 2024-04-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.8.8) nodejs-1:18.19.1-1.module+el8.8.0+21592+14a8b93e.aarch64::nodejs:18, nodejs-1:18.19.1-1.module+el8.8.0+21592+14a8b93e.ppc64le::nodejs:18, nodejs-1:18.19.1-1.module+el8.8.0+21592+14a8b93e.s390x::nodejs:18 +20

Fixes 3 records

TI-2024-14640 CVE-2024-22019 · GHSA-prhj-8562-p8gj

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted…

MEDIUM 45

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03168 Published 2024-02-20 Partial fix · 18.19.1, 20.11.1 +1 CWE-404

TI-2024-14553 CVE-2024-21892 · GHSA-f27j-4f6g-jp27

Improper privilege management in NodeJS Node

LOW 37

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00562 Published 2024-02-20 Fixed in 18.19.1, 20.11.1 +1 CWE-269

TI-2023-25282 CVE-2023-46809 · GHSA-xfgw-qcmv-354j

Node.js versions which bundle an unpatched version of OpenSSL or run against a…

LOW 37

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.01302 Published 2024-09-07 Partial fix · 18.19.1, 20.11.1 +1 CWE-385