Summary
nodejs
[1:14.17.3-2]
- Resolves: RHBZ#1980032, RHBZ#1978203
- Resolves RHBZ#1842826
- Don't use patch3
[1:14.17.3-1]
- Resolves: RHBZ#1980032, RHBZ#1978203
- Resolves RHBZ#1842826
- Resolves CVE-2021-22918(libuv), use system cipher list
[1:14.16.0-3]
- Resolves: RHBZ#1930775
- Always build with systemtap
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | nodejs | 1:14.17.3-2.module+el8.4.0+20278+965e0649 |
| Oracle Linux · 8 | nodejs-devel | 1:14.17.3-2.module+el8.4.0+20278+965e0649 |
| Oracle Linux · 8 | nodejs-docs | 1:14.17.3-2.module+el8.4.0+20278+965e0649 |
| Oracle Linux · 8 | nodejs-full-i18n | 1:14.17.3-2.module+el8.4.0+20278+965e0649 |
| Oracle Linux · 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.3.0+7818+6cd30d85 |
| Oracle Linux · 8 | nodejs-packaging | 0:23-3.module+el8.3.0+7818+6cd30d85 |
| Oracle Linux · 8 | npm | 1:6.14.13-1.14.17.3.2.module+el8.4.0+20278+965e0649 |
Vulnerabilities 3
-
High 7.5
Regular Expression Denial of Service (ReDoS)
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the stri…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
-
Unscored —CVE-2021-22918 EPSS 23%
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to conve…