Skip to content
OpenAdvisories
Medium ALAS2023-2023-243 2 CVEs

Moderate: nodejs security update (Amazon Linux 2023)

Published Jul 5, 2023 · Updated Jul 20, 2023

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23918: It is possible to bypass Permissions and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy (https://nodejs.org/api/permissions.html#policies). CVE-2022-4904: A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs 1:18.12.1-1.amzn2023.0.6
Amazon Linux · 2023 nodejs-debuginfo 1:18.12.1-1.amzn2023.0.6
Amazon Linux · 2023 nodejs-debugsource 1:18.12.1-1.amzn2023.0.6
Amazon Linux · 2023 nodejs-devel 1:18.12.1-1.amzn2023.0.6
Amazon Linux · 2023 nodejs-docs 1:18.12.1-1.amzn2023.0.6
Amazon Linux · 2023 nodejs-full-i18n 1:18.12.1-1.amzn2023.0.6
Amazon Linux · 2023 nodejs-libs 1:18.12.1-1.amzn2023.0.6
Amazon Linux · 2023 nodejs-libs-debuginfo 1:18.12.1-1.amzn2023.0.6
Amazon Linux · 2023 npm 1:8.19.2-1.18.12.1.1.amzn2023.0.6
Amazon Linux · 2023 v8-devel 2:10.2.154.15-1.18.12.1.1.amzn2023.0.6

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-4904.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-23918.html