Skip to content
OpenAdvisories
Low ALAS2-2024-2410 1 CVE

Low: libuv security update (Amazon Linux 2)

Published Jan 3, 2024 · Updated Jan 9, 2024

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-22918: Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 libuv 1:1.39.0-1.amzn2.0.1
Amazon Linux · 2 libuv-debuginfo 1:1.39.0-1.amzn2.0.1
Amazon Linux · 2 libuv-devel 1:1.39.0-1.amzn2.0.1
Amazon Linux · 2 libuv-static 1:1.39.0-1.amzn2.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-22918.html