Skip to content
OpenAdvisories
Medium ALAS2023-2024-694 3 CVEs

Moderate: nodejs security update (Amazon Linux 2023)

Published Aug 1, 2024 · Updated Aug 6, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-30261: Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1. CVE-2024-30260: Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1. CVE-2024-27982: NOTE: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs 1:18.20.2-1.amzn2023.0.1
Amazon Linux · 2023 nodejs-debuginfo 1:18.20.2-1.amzn2023.0.1
Amazon Linux · 2023 nodejs-debugsource 1:18.20.2-1.amzn2023.0.1
Amazon Linux · 2023 nodejs-devel 1:18.20.2-1.amzn2023.0.1
Amazon Linux · 2023 nodejs-docs 1:18.20.2-1.amzn2023.0.1
Amazon Linux · 2023 nodejs-full-i18n 1:18.20.2-1.amzn2023.0.1
Amazon Linux · 2023 nodejs-libs 1:18.20.2-1.amzn2023.0.1
Amazon Linux · 2023 nodejs-libs-debuginfo 1:18.20.2-1.amzn2023.0.1
Amazon Linux · 2023 nodejs-npm 1:10.5.0-1.18.20.2.1.amzn2023.0.1
Amazon Linux · 2023 v8-10.2-devel 3:10.2.154.26-1.18.20.2.1.amzn2023.0.1

Vulnerabilities 3

  • Medium 6.5
    CVE-2024-27982

    The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.9
    CVE-2024-30260

    Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

    Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

    Node.js undici nodejs nodejs18 Debian Ubuntu Azure Linux npm
  • Low 2.6
    CVE-2024-30261

    Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

    Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28…

    Node.js undici nodejs nodejs18 Debian Ubuntu Azure Linux npm

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-27982.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-30260.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-30261.html