Summary
nodejs
[1:16.20.2-2]
- Rebase to 16.20.2
Resolves: rhbz#2231866
Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559
nodejs-nodemon
[3.0.1-1]
- Rebase to 3.0.1
Resolves: CVE-2022-25883
nodejs-packaging
[26-1]
- nodejs.prov: find namespaced bundled dependencies
- Apply https://src.fedoraproject.org/rpms/nodejs-packaging/c/e24e7df
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | nodejs | 1:16.20.2-2.module+el8.8.0+21172+0baa0bae |
| Oracle Linux · 8 | nodejs-devel | 1:16.20.2-2.module+el8.8.0+21172+0baa0bae |
| Oracle Linux · 8 | nodejs-docs | 1:16.20.2-2.module+el8.8.0+21172+0baa0bae |
| Oracle Linux · 8 | nodejs-full-i18n | 1:16.20.2-2.module+el8.8.0+21172+0baa0bae |
| Oracle Linux · 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+21172+0baa0bae |
| Oracle Linux · 8 | nodejs-packaging | 0:26-1.module+el8.8.0+21172+0baa0bae |
| Oracle Linux · 8 | npm | 1:8.19.4-1.16.20.2.2.module+el8.8.0+21172+0baa0bae |
Vulnerabilities 4
-
Critical 9.8
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition f…
-
High 8.8
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the poli…
-
High 7.5
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.…
-
Medium 5.3
semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.