Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The package has been upgraded to a later upstream version: nodejs (18.16.1). (BZ#2223630, BZ#2223631, BZ#2223632, BZ#2223633, BZ#2223635, BZ#2223642)
Security Fix(es):
* nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
* nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
* nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
* nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* nodejs:18/nodejs: Don't assume FIPS is disabled by default [almalinux-8] (BZ#2223639)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | nodejs | 1:18.16.1-1.module_el8.8.0+3595+0818e803 |
| AlmaLinux · 8 | nodejs-devel | 1:18.16.1-1.module_el8.8.0+3595+0818e803 |
| AlmaLinux · 8 | nodejs-docs | 1:18.16.1-1.module_el8.8.0+3595+0818e803 |
| AlmaLinux · 8 | nodejs-full-i18n | 1:18.16.1-1.module_el8.8.0+3595+0818e803 |
| AlmaLinux · 8 | nodejs-nodemon | 2.0.20-2.module_el8.8.0+3587+ee652244 |
| AlmaLinux · 8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux · 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux · 8 | npm | 1:9.5.1-1.18.16.1.1.module_el8.8.0+3595+0818e803 |
Vulnerabilities 4
-
High 7.5
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outs…
-
High 7.5
llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…
-
Unscored —
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect te…
-
Unscored —
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, t…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-30581
-
report
https://access.redhat.com/security/cve/CVE-2023-30588
-
report
https://access.redhat.com/security/cve/CVE-2023-30589
-
report
https://access.redhat.com/security/cve/CVE-2023-30590
-
report
https://bugzilla.redhat.com/2219824
-
report
https://bugzilla.redhat.com/2219838
-
report
https://bugzilla.redhat.com/2219841
-
report
https://bugzilla.redhat.com/2219842
-
report
https://bugzilla.redhat.com/2223630
-
report
https://bugzilla.redhat.com/2223642
-
advisory
https://errata.almalinux.org/8/ALSA-2023-4536.html