Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 9

• Critical 9.8
  CVE-2021-3918

  Prototype Pollution in kriszyp/json-schema

  json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  kriszyp kriszyp/json-schema json-schema node-json-schema Debian Ubuntu npm
  Nov 13, 2021
• High 8.2
  CVE-2021-37701

  Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

  The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is …

  npm node-tar nodejs tar Debian Ubuntu Alpine npm
  Aug 31, 2021
• High 8.2
  CVE-2021-37712

  Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

  The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is…

  npm node-tar nodejs tar Debian Ubuntu Alpine npm
  Aug 31, 2021
• High 7.5
  CVE-2021-33502

  ReDoS in normalize-url

  The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

  nodejs-nodemon node-yarnpkg node-got node-got Debian Ubuntu Azure Linux npm
  May 24, 2021
• High 7.5
  CVE-2021-3807

  Inefficient Regular Expression Complexity in chalk/ansi-regex

  ansi-regex is vulnerable to Inefficient Regular Expression Complexity

  chalk chalk/ansi-regex node-ansi-regex node-ansi-regex Debian Ubuntu npm
  Sep 17, 2021
• High 7.3
  CVE-2020-7788

  Prototype Pollution

  This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

  js-jquery nodejs-nodemon node-ini ini Debian Ubuntu Azure Linux npm
  Dec 11, 2020
• Medium 5.3
  CVE-2020-28469

  Regular Expression Denial of Service (ReDoS)

  This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

  js-jquery nodejs-nodemon node-glob-parent glob-parent Debian Azure Linux npm
  Jun 3, 2021
• Unscored —
  CVE-2021-22959

  The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Re…

  Node.js node nodejs nodejs Debian Alpine
  Nov 15, 2021
• Unscored —
  CVE-2021-22960

  The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. T…

  Node.js node nodejs nodejs Debian Alpine
  Nov 3, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1907444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1945459
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1964461
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1999731
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1999739
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2007557
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2014057
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2014059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2024702
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0246.json
• report
  https://access.redhat.com/security/cve/CVE-2020-7788
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7788
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7788
• report
  https://access.redhat.com/security/cve/CVE-2020-28469
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28469
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28469
• article
  https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
• report
  https://access.redhat.com/security/cve/CVE-2021-3807
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3807
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3807
• article
  https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
• report
  https://access.redhat.com/security/cve/CVE-2021-3918
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3918
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3918
• report
  https://access.redhat.com/security/cve/CVE-2021-22959
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-22959
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-22959
• article
  https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-22960
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-22960
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-22960
• report
  https://access.redhat.com/security/cve/CVE-2021-33502
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33502
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33502
• article
  https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539
• report
  https://access.redhat.com/security/cve/CVE-2021-37701
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-37701
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-37701