High ELSA-2022-6964 2 CVEs

Important: nodejs:16 security update (Oracle Linux 8)

Published Oct 18, 2022 · Updated Oct 18, 2022

Ecosystem: Oracle Linux

Summary

nodejs
[1:16.17.1-1]
- Rebase to version 16.17.1
- Resolves: CVE-2022-35255 CVE-2022-35256
- Resolves: #2132004, #2130552
- Resolves #2121095

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 8	nodejs	1:16.17.1-1.module+el8.6.0+20846+72f1269d
Oracle Linux · 8	nodejs-devel	1:16.17.1-1.module+el8.6.0+20846+72f1269d
Oracle Linux · 8	nodejs-docs	1:16.17.1-1.module+el8.6.0+20846+72f1269d
Oracle Linux · 8	nodejs-full-i18n	1:16.17.1-1.module+el8.6.0+20846+72f1269d
Oracle Linux · 8	nodejs-nodemon	0:2.0.19-2.module+el8.6.0+20846+72f1269d
Oracle Linux · 8	nodejs-packaging	0:25-1.module+el8.5.0+20388+4b61e68d
Oracle Linux · 8	npm	1:8.15.0-1.16.17.1.1.module+el8.6.0+20846+72f1269d

Vulnerabilities 2

Critical 9.1

CVE-2022-35255

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in Secret…

Node.js node nodejs nodejs Debian Alpine

Dec 5, 2022
Medium 6.5

CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…

Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine Wolfi

Dec 5, 2022