Summary
nodejs
[1:16.18.1-3]
- Update sources of undici WASM blobs
Resolves: rhbz#2151617
[1:16.18.1-2]
- Add back libs and v8-devel subpackages
- Related: RHBZ#2121126
- Record previously fixed CVE
- Resolves: CVE-2021-44906
[1:16.18.1-1]
- Rebase + CVEs
- Resolves: #2142808
- Resolves: #2142826, #2131745, #2142855
nodejs-nodemon
[2.0.20-2]
- Record CVE fixed in the current or previous upstream versions
- Resolves: CVE-2021-44906
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | nodejs | 1:16.18.1-3.el9_1 |
| Oracle Linux · 9 | nodejs-docs | 1:16.18.1-3.el9_1 |
| Oracle Linux · 9 | nodejs-full-i18n | 1:16.18.1-3.el9_1 |
| Oracle Linux · 9 | nodejs-libs | 1:16.18.1-3.el9_1 |
| Oracle Linux · 9 | nodejs-nodemon | 0:2.0.20-2.el9_1 |
| Oracle Linux · 9 | npm | 1:8.19.2-1.16.18.1.3.el9_1 |
Vulnerabilities 4
-
Critical 9.8CVE-2021-44906 Public exploit
Prototype Pollution in minimist
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
-
High 8.1CVE-2022-43548 EPSS 15%
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insuffi…
-
High 7.5
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
-
Medium 6.5
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…