Red Hat Security Advisory

RHSA-2024:5814

nodejs:20 security update

Released 2024-08-26 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.16.0-1.module+el8.10.0+22203+a88c8310.aarch64::nodejs:20, nodejs-1:20.16.0-1.module+el8.10.0+22203+a88c8310.ppc64le::nodejs:20, nodejs-1:20.16.0-1.module+el8.10.0+22203+a88c8310.s390x::nodejs:20 +20

TI-2024-19062 CVE-2024-28863 · GHSA-f5x3-32g6-xq36

MEDIUM 62

node-tar is a Tar for Node.js.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00929 Published 2024-03-21 Partial fix · 6.2.1 CWE-400

TI-2024-14641 CVE-2024-22020 · GHSA-ch4x-f5c4-36gv

LOW 33

A security flaw in Node.js allows a bypass of network import restrictions.

CVSS 3.0MEDIUM 6.5 Local No auth User interaction EPSS 0.01104 Published 2024-07-09 Partial fix · 18.20.4, 20.15.1 +1 CWE-94

TI-2024-23962 CVE-2024-36137 · GHSA-q793-mj5v-wh68

LOW 16

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.

CVSS 3.0LOW 3.3 Local Low privileges No interaction EPSS 0.00395 Published 2024-09-07 Partial fix · 20.15.1, 22.4.1

TI-2024-14639 CVE-2024-22018 · GHSA-9xvm-xmw3-2hm2

LOW 15

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.

CVSS 3.0LOW 2.9 Local No auth No interaction EPSS 0.00458 Published 2024-07-10 Partial fix · 20.15.1, 22.4.1