Summary
nodejs
[1:16.20.1-1]
- Rebase to 16.20.1
Resolves: rhbz#2188289
Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590
- Replace /usr/etc/npmrc symlink with builtin configuration
Resolves: rhbz#2222288
nodejs-nodemon
nodejs-packaging
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | nodejs | 1:16.20.1-1.module+el8.8.0+21143+178952bb |
| Oracle Linux · 8 | nodejs-devel | 1:16.20.1-1.module+el8.8.0+21143+178952bb |
| Oracle Linux · 8 | nodejs-docs | 1:16.20.1-1.module+el8.8.0+21143+178952bb |
| Oracle Linux · 8 | nodejs-full-i18n | 1:16.20.1-1.module+el8.8.0+21143+178952bb |
| Oracle Linux · 8 | nodejs-nodemon | 0:2.0.20-3.module+el8.8.0+21143+178952bb |
| Oracle Linux · 8 | nodejs-packaging | 0:25-1.module+el8.5.0+20388+4b61e68d |
| Oracle Linux · 8 | npm | 1:8.19.4-1.16.20.1.1.module+el8.8.0+21143+178952bb |
Vulnerabilities 4
-
High 7.5
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outs…
-
High 7.5
llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…
-
Unscored —
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect te…
-
Unscored —
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, t…