High ELSA-2022-6963 2 CVEs

Important: nodejs security update (Oracle Linux 9)

Published Oct 17, 2022 · Updated Oct 17, 2022

Ecosystem: Oracle Linux

Summary

[16.17.1-1]
- Rebase to version 16.17.1
Resolves: CVE-2022-35255 CVE-2022-35256

Fixed packages 5

Release	Package	Fixed in
Oracle Linux · 9	nodejs	1:16.17.1-1.el9_0
Oracle Linux · 9	nodejs-docs	1:16.17.1-1.el9_0
Oracle Linux · 9	nodejs-full-i18n	1:16.17.1-1.el9_0
Oracle Linux · 9	nodejs-libs	1:16.17.1-1.el9_0
Oracle Linux · 9	npm	1:8.15.0-1.16.17.1.1.el9_0

Vulnerabilities 2

Critical 9.1

CVE-2022-35255

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in Secret…

Node.js node nodejs nodejs Debian Alpine

Dec 5, 2022
Medium 6.5

CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…

Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine Wolfi

Dec 5, 2022