ELSA-2022-6448 — Moderate: nodejs:14 security and bug fix update (Oracle Linux 8)

Summary

nodejs
[1:14.20.0-2]
- Replace with_* macros with RPM confitionals
- Unify configure calls into single command
- Refactor bootstrap-related parts
- Decouple dependency bundling from bootstrapping
- Resolves: RHBZ#2111417

[1:14.20.0-1]
- Rebase to latest version
- Resolves: RHBZ#2106367
- CVE fixes for CVE-2022-32212/3/4/5
- Resolves: #2109576, #2109579, #2109582, #2109585

[1:14.18.2-3]
- Resolves: RHBZ#2029519
- Add missing BZ to changelog

nodejs-nodemon
[2.0.19-2]
- Switched from autosetup
- Removed CODE_OF_CONDUCT.md and faq.md which is not present in npmjs package, might switch to GH sources in the future
- Resolves: RHBZ#2109919

[2.0.19-1]
- Rebase to 2.0.19
- Resolves CVE-2022-33987
- Resolves: RHBZ#2109919

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 8	nodejs	1:14.20.0-2.module+el8.6.0+20729+8fb6d84e
Oracle Linux · 8	nodejs-devel	1:14.20.0-2.module+el8.6.0+20729+8fb6d84e
Oracle Linux · 8	nodejs-docs	1:14.20.0-2.module+el8.6.0+20729+8fb6d84e
Oracle Linux · 8	nodejs-full-i18n	1:14.20.0-2.module+el8.6.0+20729+8fb6d84e
Oracle Linux · 8	nodejs-nodemon	0:2.0.19-2.module+el8.6.0+20729+8fb6d84e
Oracle Linux · 8	nodejs-packaging	0:23-3.module+el8.3.0+7818+6cd30d85
Oracle Linux · 8	npm	1:6.14.17-1.14.20.0.2.module+el8.6.0+20729+8fb6d84e

Vulnerabilities 5

Critical 9.1

CVE-2022-32213 EPSS 45%

llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm

Jul 14, 2022
Critical 9.1

CVE-2022-32214 EPSS 82%

llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm

Jul 14, 2022
Medium 5.3

CVE-2022-33987

Got allows a redirect to a UNIX socket

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

node-got node-got got Debian Ubuntu npm

Jun 18, 2022
Unscored —

CVE-2022-32212

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAl…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jul 14, 2022
Unscored —

CVE-2022-32215 EPSS 70%

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …

Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine

Jul 14, 2022

Moderate: nodejs:14 security and bug fix update (Oracle Linux 8)

Summary

Fixed packages 7

Vulnerabilities 5

llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

Got allows a redirect to a UNIX socket

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAl…

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …