Important: nodejs:14 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

Fixed packages 7

Vulnerabilities 7

• High 8.6
  CVE-2022-4904

  A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…

  nodejs c-ares grpc c-ares Debian Ubuntu Azure Linux
  Mar 6, 2023
• High 7.5
  CVE-2021-35065

  glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service

  The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

  glob-parent node-glob-parent node-glob-parent Debian Ubuntu npm
  Dec 26, 2022
• High 7.5
  CVE-2022-3517

  minimatch ReDoS vulnerability

  A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

  js-jquery nodejs-nodemon minimatch node-minimatch Debian Ubuntu Azure Linux npm
  Oct 17, 2022
• High 7.5
  CVE-2022-38900 EPSS 23%

  decode-uri-component vulnerable to Denial of Service (DoS)

  decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

  js-jquery decode-uri-component Azure Linux npm
  Nov 28, 2022
• High 7.5
  CVE-2023-23918

  A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible t…

  Node.js node nodejs nodejs Debian Azure Linux Alpine
  Feb 23, 2023
• Medium 5.3
  CVE-2022-25881

  http-cache-semantics vulnerable to Regular Expression Denial of Service

  This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

  nodejs nodejs-nodemon org.webjars.npm:http-cache-semantics http-cache-semantics Azure Linux npm Maven
  Jan 31, 2023
• Medium 4.2
  CVE-2023-23920

  An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Feb 23, 2023