Skip to content
OpenAdvisories
High ALAS2023-2024-544 8 CVEs

Important: nodejs20 security update (Amazon Linux 2023)

Published Feb 29, 2024 · Updated Mar 13, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24758: Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2024-22025: NOTE: https://nodejs.org/en/blog/release/v18.19.1 NOTE: https://github.com/nodejs/node/commit/f31d47e135973746c4f490d5eb635eded8bb3dda (v18.x) NOTE: https://github.com/nodejs/node/commit/9052ef43dc2d1b0db340591a9bc9e45a25c01d90 (main) CVE-2024-22019: A flaw was found in Node.js due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which can allow an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and a denial of service. CVE-2024-22017: NOTE: https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/#setuid-does-not-drop-all-privileges-due-to-io_uring-cve-2024-22017---high CVE-2024-21896: NOTE: https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/#path-traversal-by-monkey-patching-buffer-internals-cve-2024-21896---high CVE-2024-21892: A flaw was found in Node.js. On Linux, Node.js ignores certain environment variables if they have been set by an unprivileged user while the process is running with elevated privileges, with the exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when other capabilities have been set. This may allow unprivileged users to inject code that inherits the processes elevated privileges. CVE-2024-21891: NOTE: https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/#multiple-permission-model-bypasses-due-to-improper-path-traversal-sequence-sanitization-cve-2024-21891---medium CVE-2024-21890: The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. This misleading documentation affects all users using the experimental permission model in active release lines: 20.x and 21.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs20 1:20.11.1-1.amzn2023.0.1
Amazon Linux · 2023 nodejs20-debuginfo 1:20.11.1-1.amzn2023.0.1
Amazon Linux · 2023 nodejs20-debugsource 1:20.11.1-1.amzn2023.0.1
Amazon Linux · 2023 nodejs20-devel 1:20.11.1-1.amzn2023.0.1
Amazon Linux · 2023 nodejs20-docs 1:20.11.1-1.amzn2023.0.1
Amazon Linux · 2023 nodejs20-full-i18n 1:20.11.1-1.amzn2023.0.1
Amazon Linux · 2023 nodejs20-libs 1:20.11.1-1.amzn2023.0.1
Amazon Linux · 2023 nodejs20-libs-debuginfo 1:20.11.1-1.amzn2023.0.1
Amazon Linux · 2023 nodejs20-npm 1:10.2.4-1.20.11.1.1.amzn2023.0.1
Amazon Linux · 2023 v8-11.3-devel 3:11.3.244.8-1.20.11.1.1.amzn2023.0.1

Vulnerabilities 8

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-21890.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-21891.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-21892.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-21896.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-22017.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-22019.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-22025.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-24758.html