High ELSA-2024-1503 3 CVEs

Important: nodejs:18 security update (Oracle Linux 9)

Published Mar 26, 2024 · Updated Mar 26, 2024

Ecosystem: Oracle Linux

Summary

nodejs
[1:18.19.1-1]
- Rebase to version 18.19.1
- Fixes: CVE-2024-21892 CVE-2024-22019 (high)
- Fixes: CVE-2023-46809 (medium)

nodejs-nodemon
nodejs-packaging

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 9	nodejs	1:18.19.1-1.module+el9.3.0+90193+90aa0dae
Oracle Linux · 9	nodejs-devel	1:18.19.1-1.module+el9.3.0+90193+90aa0dae
Oracle Linux · 9	nodejs-docs	1:18.19.1-1.module+el9.3.0+90193+90aa0dae
Oracle Linux · 9	nodejs-full-i18n	1:18.19.1-1.module+el9.3.0+90193+90aa0dae
Oracle Linux · 9	nodejs-nodemon	0:3.0.1-1.module+el9.3.0+90167+01064547
Oracle Linux · 9	nodejs-packaging	0:2021.06-4.module+el9.1.0+20762+f52d7401
Oracle Linux · 9	nodejs-packaging-bundler	0:2021.06-4.module+el9.1.0+20762+f52d7401
Oracle Linux · 9	npm	1:10.2.4-1.18.19.1.1.module+el9.3.0+90193+90aa0dae

Vulnerabilities 3

High 7.5

CVE-2024-21892

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the pr…

Node.js node openjdk17 nodejs Debian Azure Linux Alpine Wolfi

Feb 20, 2024
High 7.5

CVE-2024-22019

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encodi…

Node.js node nodejs nodejs Debian Azure Linux Wolfi

Feb 20, 2024
High 7.4

CVE-2023-46809

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL wh…

Node.js node nodejs nodejs Debian Ubuntu Wolfi

Sep 7, 2024