Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

Fixed packages 6

Vulnerabilities 4

• High 7.5
  CVE-2021-27290

  Regular Expression Denial of Service (ReDoS)

  ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the stri…

  nodejs node-ssri node-ssri ssri Debian Ubuntu Alpine npm
  Mar 12, 2021
• High 7.5
  CVE-2021-33502

  ReDoS in normalize-url

  The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

  nodejs-nodemon node-yarnpkg node-got node-got Debian Ubuntu Azure Linux npm
  May 24, 2021
• Medium 5.3
  CVE-2021-23362

  Regular Expression Denial of Service (ReDoS)

  The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

  js-jquery hosted-git-info node-hosted-git-info node-hosted-git-info Debian Ubuntu Azure Linux npm
  Mar 23, 2021
• Unscored —
  CVE-2021-22918 EPSS 23%

  Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to conve…

  Node.js node nodejs pytorch Debian Ubuntu Azure Linux Alpine
  Jul 12, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1941471
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1942591
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1943208
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1964461
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1979338
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2932.json
• report
  https://access.redhat.com/security/cve/CVE-2021-22918
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-22918
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-22918
• article
  https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-23362
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23362
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23362
• report
  https://access.redhat.com/security/cve/CVE-2021-27290
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-27290
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-27290
• report
  https://access.redhat.com/security/cve/CVE-2021-33502
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33502
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33502
• article
  https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539