Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs | 1:14.17.3-2.module+el8.4.0+11738+3bd42762 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debuginfo | 1:14.17.3-2.module+el8.4.0+11738+3bd42762 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debugsource | 1:14.17.3-2.module+el8.4.0+11738+3bd42762 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-devel | 1:14.17.3-2.module+el8.4.0+11738+3bd42762 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-docs | 1:14.17.3-2.module+el8.4.0+11738+3bd42762 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-full-i18n | 1:14.17.3-2.module+el8.4.0+11738+3bd42762 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-nodemon | 0:2.0.3-1.module+el8.3.0+6519+9f98ed83 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-packaging | 0:23-3.module+el8.3.0+6519+9f98ed83 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | npm | 1:6.14.13-1.14.17.3.2.module+el8.4.0+11738+3bd42762 |
Vulnerabilities 3
-
High 7.5
Regular Expression Denial of Service (ReDoS)
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the stri…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
-
Unscored —CVE-2021-22918 EPSS 23%
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to conve…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1941471
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1943208
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1979338
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3074.json
-
report
https://access.redhat.com/security/cve/CVE-2021-22918
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-22918
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-22918
-
article
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/
-
report
https://access.redhat.com/security/cve/CVE-2021-23362
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-23362
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-23362
-
report
https://access.redhat.com/security/cve/CVE-2021-27290
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-27290
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-27290