Skip to content
OpenAdvisories
Medium ALAS2023-2024-568 3 CVEs

Moderate: nodejs security update (Amazon Linux 2023)

Published Mar 13, 2024 · Updated Mar 21, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-25629: c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist. CVE-2024-24758: Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2024-22025: NOTE: https://nodejs.org/en/blog/release/v18.19.1 NOTE: https://github.com/nodejs/node/commit/f31d47e135973746c4f490d5eb635eded8bb3dda (v18.x) NOTE: https://github.com/nodejs/node/commit/9052ef43dc2d1b0db340591a9bc9e45a25c01d90 (main)

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs 1:18.18.2-1.amzn2023.0.3
Amazon Linux · 2023 nodejs-debuginfo 1:18.18.2-1.amzn2023.0.3
Amazon Linux · 2023 nodejs-debugsource 1:18.18.2-1.amzn2023.0.3
Amazon Linux · 2023 nodejs-devel 1:18.18.2-1.amzn2023.0.3
Amazon Linux · 2023 nodejs-docs 1:18.18.2-1.amzn2023.0.3
Amazon Linux · 2023 nodejs-full-i18n 1:18.18.2-1.amzn2023.0.3
Amazon Linux · 2023 nodejs-libs 1:18.18.2-1.amzn2023.0.3
Amazon Linux · 2023 nodejs-libs-debuginfo 1:18.18.2-1.amzn2023.0.3
Amazon Linux · 2023 nodejs-npm 1:9.8.1-1.18.18.2.1.amzn2023.0.3
Amazon Linux · 2023 v8-10.2-devel 3:10.2.154.26-1.18.18.2.1.amzn2023.0.3

Vulnerabilities 3

  • Medium 6.5
    CVE-2024-22025

    A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhausti…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Wolfi
  • Medium 4.4
    CVE-2024-25629

    c-ares out of bounds read in ares__read_line()

    c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file.…

    c-ares c-ares nodejs nodejs18 Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.9
    CVE-2024-24758

    Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici

    Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advis…

    Node.js undici nodejs node-undici Debian Ubuntu Azure Linux npm

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-22025.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-24758.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-25629.html