Red Hat Security Advisory: rh-nodejs12-nodejs security, bug fix, and enhancement update

Fixed packages 5

Vulnerabilities 10

• Critical 9.8
  CVE-2021-3918

  Prototype Pollution in kriszyp/json-schema

  json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  kriszyp kriszyp/json-schema json-schema node-json-schema Debian Ubuntu npm
  Nov 13, 2021
• Critical 9.8
  CVE-2021-44906 Public exploit

  Prototype Pollution in minimist

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  js-jquery node-minimist node-minimist minimist Debian Ubuntu Azure Linux npm
  Mar 17, 2022
• High 8.2
  CVE-2021-37701

  Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

  The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is …

  npm node-tar nodejs tar Debian Ubuntu Alpine npm
  Aug 31, 2021
• High 8.2
  CVE-2021-37712

  Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

  The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is…

  npm node-tar nodejs tar Debian Ubuntu Alpine npm
  Aug 31, 2021
• Unscored —
  CVE-2021-22959

  The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Re…

  Node.js node nodejs nodejs Debian Alpine
  Nov 15, 2021
• Unscored —
  CVE-2021-22960

  The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. T…

  Node.js node nodejs nodejs Debian Alpine
  Nov 3, 2021
• Unscored —
  CVE-2021-44531

  Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN …

  Node.js node openjdk11 nodejs Debian Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2021-44532 EPSS 10%

  Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It …

  Node.js node nodejs openjdk11 Debian Ubuntu Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2021-44533

  Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly…

  Node.js node nodejs openjdk11 Debian Ubuntu Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2022-21824 EPSS 22%

  Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be pass…

  Node.js node openjdk11 nodejs Debian Azure Linux Alpine
  Feb 24, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1999731
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1999739
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2014057
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2014059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2024702
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040846
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066009
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4914.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3918
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3918
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3918
• report
  https://access.redhat.com/security/cve/CVE-2021-22959
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-22959
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-22959
• article
  https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-22960
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-22960
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-22960
• report
  https://access.redhat.com/security/cve/CVE-2021-37701
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-37701
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-37701
• article
  https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc
• article
  https://www.npmjs.com/advisories/1779
• report
  https://access.redhat.com/security/cve/CVE-2021-37712
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-37712
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-37712
• article
  https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p
• article
  https://www.npmjs.com/advisories/1780
• report
  https://access.redhat.com/security/cve/CVE-2021-44531
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44531
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44531
• article
  https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-44532
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44532
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44532