Summary
nodejs
[1:12.22.3-2]
- Resolves: RHBZ#1980031, RHBZ#1978201
- Fix typo, BR systemtap-sdt-level always, remove y18n patch
[1:12.22.3-1]
- Resolves: RHBZ#1980031, RHBZ#1978201
- Resolves #1952915
- Resolves CVE-2021-22918(libuv), use system cipher list
nodejs-nodemon
[2.0.3-1]
- Resolves: RHBZ#1920692, RHBZ#1804236, RHBZ#1803247
- Rebase to 2.0.3
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | nodejs | 1:12.22.3-2.module+el8.4.0+20281+eb64e322 |
| Oracle Linux · 8 | nodejs-devel | 1:12.22.3-2.module+el8.4.0+20281+eb64e322 |
| Oracle Linux · 8 | nodejs-docs | 1:12.22.3-2.module+el8.4.0+20281+eb64e322 |
| Oracle Linux · 8 | nodejs-full-i18n | 1:12.22.3-2.module+el8.4.0+20281+eb64e322 |
| Oracle Linux · 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.4.0+20281+eb64e322 |
| Oracle Linux · 8 | nodejs-packaging | 0:17-3.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux · 8 | npm | 1:6.14.13-1.12.22.3.2.module+el8.4.0+20281+eb64e322 |
Vulnerabilities 3
-
High 7.5
Regular Expression Denial of Service (ReDoS)
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the stri…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
-
Unscored —CVE-2021-22918 EPSS 23%
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to conve…