Skip to content
OpenAdvisories
High ELSA-2021-3666 8 CVEs

Important: nodejs:14 security and bug fix update (Oracle Linux 8)

Published Sep 27, 2021 · Updated Sep 27, 2021

Ecosystem: Oracle Linux

Summary

nodejs
[1:14.17.5-1]
- Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940,
- CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
- Resolves RHBZ#1847529 (make FIPS always available)
- Resolves: RHBZ#1988599, RHBZ#1994000, RHBZ#1993998, RHBZ#1993095
- Resolves: RHBZ#1994028, RHBZ#1994402, RHBZ#1994406, RHBZ#1994398
- Resolves: RHBZ#1993924 (make FIPS always available)

[1:14.17.3-3]
- Resolves: RHBZ#1991584, RHBZ#1991578
- Resolves CVE-2021-23362 CVE-2021-27290
- Bump for missing mentions of CVEs

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 8 nodejs 1:14.17.5-1.module+el8.4.0+20313+f90c2973
Oracle Linux · 8 nodejs-devel 1:14.17.5-1.module+el8.4.0+20313+f90c2973
Oracle Linux · 8 nodejs-docs 1:14.17.5-1.module+el8.4.0+20313+f90c2973
Oracle Linux · 8 nodejs-full-i18n 1:14.17.5-1.module+el8.4.0+20313+f90c2973
Oracle Linux · 8 nodejs-nodemon 0:2.0.3-1.module+el8.3.0+7818+6cd30d85
Oracle Linux · 8 nodejs-packaging 0:23-3.module+el8.3.0+7818+6cd30d85
Oracle Linux · 8 npm 1:6.14.14-1.14.17.5.1.module+el8.4.0+20313+f90c2973

Vulnerabilities 8

  • High 8.2
    CVE-2021-32803

    Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

    The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a s…

    npm node-tar tar node-tar Debian Ubuntu npm
  • High 8.2
    CVE-2021-32804 Public exploit EPSS 15%

    Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

    The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning ab…

    npm node-tar tar node-tar Debian Ubuntu npm
  • Medium 5.3
    CVE-2021-23343

    Regular Expression Denial of Service (ReDoS)

    All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

    path-parse npm
  • Unscored —
    CVE-2021-22930 EPSS 36%

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to…

    Node.js node nodejs nodejs Debian Azure Linux Alpine
  • Unscored —
    CVE-2021-22931 EPSS 22%

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to mis…

    Node.js node nodejs nodejs Azure Linux Alpine
  • Unscored —
    CVE-2021-22939 EPSS 15%

    If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2021-22940 EPSS 14%

    Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to…

    Node.js node nodejs nodejs Debian Azure Linux
  • Unscored —
    CVE-2021-3672

    A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name S…

    nodejs nodejs-current ceph c-ares Debian Ubuntu Azure Linux Alpine