Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 7

• Critical 9.8
  CVE-2021-3918

  Prototype Pollution in kriszyp/json-schema

  json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  kriszyp kriszyp/json-schema json-schema node-json-schema Debian Ubuntu npm
  Nov 13, 2021
• High 7.5
  CVE-2021-33502

  ReDoS in normalize-url

  The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

  nodejs-nodemon node-yarnpkg node-got node-got Debian Ubuntu Azure Linux npm
  May 24, 2021
• High 7.5
  CVE-2021-3807

  Inefficient Regular Expression Complexity in chalk/ansi-regex

  ansi-regex is vulnerable to Inefficient Regular Expression Complexity

  chalk chalk/ansi-regex ansi-regex node-ansi-regex Debian Ubuntu npm
  Sep 17, 2021
• High 7.3
  CVE-2020-7788

  Prototype Pollution

  This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

  js-jquery nodejs-nodemon ini node-ini Debian Ubuntu Azure Linux npm
  Dec 11, 2020
• Medium 5.3
  CVE-2020-28469

  Regular Expression Denial of Service (ReDoS)

  This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

  js-jquery nodejs-nodemon glob-parent node-glob-parent Debian Azure Linux npm
  Jun 3, 2021
• Unscored —
  CVE-2021-22959

  The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Re…

  Node.js node nodejs nodejs Debian Alpine
  Nov 15, 2021
• Unscored —
  CVE-2021-22960

  The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. T…

  Node.js node nodejs nodejs Debian Alpine
  Nov 3, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1907444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1945459
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1964461
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2007557
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2014057
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2014059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2024702
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5171.json
• report
  https://access.redhat.com/security/cve/CVE-2020-7788
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7788
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7788
• report
  https://access.redhat.com/security/cve/CVE-2020-28469
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28469
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28469
• article
  https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
• report
  https://access.redhat.com/security/cve/CVE-2021-3807
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3807
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3807
• article
  https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
• report
  https://access.redhat.com/security/cve/CVE-2021-3918
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3918
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3918
• report
  https://access.redhat.com/security/cve/CVE-2021-22959
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-22959
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-22959
• article
  https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-22960
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-22960
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-22960
• report
  https://access.redhat.com/security/cve/CVE-2021-33502
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33502
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33502
• article
  https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539