Skip to content
OpenAdvisories
Critical RHSA-2022:0041 6 CVEs

Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

Published Sep 30, 2024 · Updated Oct 14, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs14-nodejs 0:14.18.2-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs14-nodejs-debuginfo 0:14.18.2-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs14-nodejs-devel 0:14.18.2-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs14-nodejs-docs 0:14.18.2-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs14-nodejs-nodemon 0:2.0.3-6.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-nodejs14-npm 0:6.14.15-14.18.2.1.el7

Vulnerabilities 6

  • Critical 9.8
    CVE-2021-3918

    Prototype Pollution in kriszyp/json-schema

    json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

    kriszyp kriszyp/json-schema json-schema node-json-schema Debian Ubuntu npm
  • High 8.2
    CVE-2021-37701

    Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

    The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is …

    npm node-tar nodejs tar Debian Ubuntu Alpine npm
  • High 8.2
    CVE-2021-37712

    Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

    The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is…

    npm node-tar nodejs tar Debian Ubuntu Alpine npm
  • High 7.5
    CVE-2021-3807

    Inefficient Regular Expression Complexity in chalk/ansi-regex

    ansi-regex is vulnerable to Inefficient Regular Expression Complexity

    chalk chalk/ansi-regex node-ansi-regex node-ansi-regex Debian Ubuntu npm
  • Unscored —
    CVE-2021-22959

    The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Re…

    Node.js node nodejs nodejs Debian Alpine
  • Unscored —
    CVE-2021-22960

    The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. T…

    Node.js node nodejs nodejs Debian Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1999731
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1999739
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2007557
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2014057
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2014059
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2024702
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2031766
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0041.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-3807
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3807
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3807
  • article
    https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
  • report
    https://access.redhat.com/security/cve/CVE-2021-3918
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3918
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3918
  • report
    https://access.redhat.com/security/cve/CVE-2021-22959
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-22959
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-22959
  • article
    https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2021-22960
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-22960
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-22960
  • report
    https://access.redhat.com/security/cve/CVE-2021-37701
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-37701
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-37701
  • article
    https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc
  • article
    https://www.npmjs.com/advisories/1779
  • report
    https://access.redhat.com/security/cve/CVE-2021-37712
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-37712
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-37712
  • article
    https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p
  • article
    https://www.npmjs.com/advisories/1780