Summary
nodejs
[1:18.17.1-1]
- Rebase to version 18.17.1
Resolves: rhbz#2228940
Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559
- Specify proper OpenSSL configuration section build
Related: rhbz#2226726
nodejs-nodemon
[3.0.1-1]
- Rebase to 3.0.1
- Resolves: CVE-2022-25883
nodejs-packaging
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | nodejs | 1:18.17.1-1.module+el9.2.0+21169+1d24b6cc |
| Oracle Linux · 9 | nodejs-devel | 1:18.17.1-1.module+el9.2.0+21169+1d24b6cc |
| Oracle Linux · 9 | nodejs-docs | 1:18.17.1-1.module+el9.2.0+21169+1d24b6cc |
| Oracle Linux · 9 | nodejs-full-i18n | 1:18.17.1-1.module+el9.2.0+21169+1d24b6cc |
| Oracle Linux · 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.2.0+21169+1d24b6cc |
| Oracle Linux · 9 | nodejs-packaging | 0:2021.06-4.module+el9.1.0+20762+f52d7401 |
| Oracle Linux · 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.1.0+20762+f52d7401 |
| Oracle Linux · 9 | npm | 1:9.6.7-1.18.17.1.1.module+el9.2.0+21169+1d24b6cc |
Vulnerabilities 4
-
Critical 9.8
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition f…
-
High 8.8
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the poli…
-
High 7.5
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.…
-
Medium 5.3
semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.