High ELSA-2021-0734 2 CVEs

Important: nodejs:12 security update (Oracle Linux 8)

Published Mar 5, 2021 · Updated Mar 5, 2021

Ecosystem: Oracle Linux

Summary

nodejs
[1:12.21.0-1]
- Resolves: RHBZ#1932315, RHBZ#1932424
- remove --debug-nghttp2 option
- remove ini patch
- Backport patch to use getauxval

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 8	nodejs	1:12.21.0-1.module+el8.3.0+9672+c7b0544d
Oracle Linux · 8	nodejs-devel	1:12.21.0-1.module+el8.3.0+9672+c7b0544d
Oracle Linux · 8	nodejs-docs	1:12.21.0-1.module+el8.3.0+9672+c7b0544d
Oracle Linux · 8	nodejs-full-i18n	1:12.21.0-1.module+el8.3.0+9672+c7b0544d
Oracle Linux · 8	nodejs-nodemon	0:2.0.3-1.module+el8.3.0+9643+8c99e187
Oracle Linux · 8	nodejs-packaging	0:17-3.module+el8.1.0+5393+aaf413e3
Oracle Linux · 8	npm	1:6.14.11-1.12.21.0.1.module+el8.3.0+9672+c7b0544d

Vulnerabilities 2

Unscored —

CVE-2021-22883 EPSS 77%

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connect…

Node.js node nodejs nodejs Debian Ubuntu Alpine

Mar 3, 2021
Unscored —

CVE-2021-22884 EPSS 37%

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes …

Node.js node nodejs nodejs Debian Ubuntu Alpine

Mar 3, 2021