Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23918: It is possible to bypass Permissions and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy (https://nodejs.org/api/permissions.html#policies). CVE-2022-4904: A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | nodejs | 1:18.12.1-1.amzn2023.0.6 |
| Amazon Linux · 2023 | nodejs-debuginfo | 1:18.12.1-1.amzn2023.0.6 |
| Amazon Linux · 2023 | nodejs-debugsource | 1:18.12.1-1.amzn2023.0.6 |
| Amazon Linux · 2023 | nodejs-devel | 1:18.12.1-1.amzn2023.0.6 |
| Amazon Linux · 2023 | nodejs-docs | 1:18.12.1-1.amzn2023.0.6 |
| Amazon Linux · 2023 | nodejs-full-i18n | 1:18.12.1-1.amzn2023.0.6 |
| Amazon Linux · 2023 | nodejs-libs | 1:18.12.1-1.amzn2023.0.6 |
| Amazon Linux · 2023 | nodejs-libs-debuginfo | 1:18.12.1-1.amzn2023.0.6 |
| Amazon Linux · 2023 | npm | 1:8.19.2-1.18.12.1.1.amzn2023.0.6 |
| Amazon Linux · 2023 | v8-devel | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.6 |
Vulnerabilities 2
-
High 8.6
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…
-
High 7.5
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible t…