Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-22918: Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libuv | 1:1.39.0-1.amzn2.0.1 |
| Amazon Linux · 2 | libuv-debuginfo | 1:1.39.0-1.amzn2.0.1 |
| Amazon Linux · 2 | libuv-devel | 1:1.39.0-1.amzn2.0.1 |
| Amazon Linux · 2 | libuv-static | 1:1.39.0-1.amzn2.0.1 |
Vulnerabilities 1
-
Unscored —CVE-2021-22918 EPSS 23%
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to conve…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-22918.html