Moderate: nodejs:14 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

Fixed packages 7

Vulnerabilities 9

• Critical 9.8
  CVE-2021-3918

  Prototype Pollution in kriszyp/json-schema

  json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  kriszyp kriszyp/json-schema json-schema node-json-schema Debian Ubuntu npm
  Nov 13, 2021
• High 8.2
  CVE-2021-37701

  Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

  The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is …

  npm node-tar nodejs tar Debian Ubuntu Alpine npm
  Aug 31, 2021
• High 8.2
  CVE-2021-37712

  Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

  The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is…

  npm node-tar nodejs tar Debian Ubuntu Alpine npm
  Aug 31, 2021
• High 7.5
  CVE-2021-33502

  ReDoS in normalize-url

  The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

  nodejs-nodemon node-yarnpkg node-got node-got Debian Ubuntu Azure Linux npm
  May 24, 2021
• High 7.5
  CVE-2021-3807

  Inefficient Regular Expression Complexity in chalk/ansi-regex

  ansi-regex is vulnerable to Inefficient Regular Expression Complexity

  chalk chalk/ansi-regex node-ansi-regex node-ansi-regex Debian Ubuntu npm
  Sep 17, 2021
• High 7.3
  CVE-2020-7788

  Prototype Pollution

  This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

  js-jquery nodejs-nodemon node-ini ini Debian Ubuntu Azure Linux npm
  Dec 11, 2020
• Medium 5.3
  CVE-2020-28469

  Regular Expression Denial of Service (ReDoS)

  This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

  js-jquery nodejs-nodemon node-glob-parent glob-parent Debian Azure Linux npm
  Jun 3, 2021
• Unscored —
  CVE-2021-22959

  The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Re…

  Node.js node nodejs nodejs Debian Alpine
  Nov 15, 2021
• Unscored —
  CVE-2021-22960

  The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. T…

  Node.js node nodejs nodejs Debian Alpine
  Nov 3, 2021