Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs | 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debuginfo | 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debugsource | 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-devel | 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-docs | 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-full-i18n | 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-nodemon | 0:2.0.19-2.module+el8.6.0+16231+7c1b33d9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-packaging | 0:23-3.module+el8.3.0+6519+9f98ed83 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | npm | 1:6.14.17-1.14.20.0.2.module+el8.6.0+16231+7c1b33d9 |
Vulnerabilities 5
-
Critical 9.1CVE-2022-32213 EPSS 45%
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
-
Critical 9.1CVE-2022-32214 EPSS 82%
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
-
Medium 5.3
Got allows a redirect to a UNIX socket
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
-
Unscored —
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAl…
-
Unscored —CVE-2022-32215 EPSS 70%
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2102001
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2105422
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2105426
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2105428
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2105430
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2106367
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6448.json
-
report
https://access.redhat.com/security/cve/CVE-2022-32212
-
advisory
https://www.cve.org/CVERecord?id=CVE-2022-32212
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-32212
-
article
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
-
report
https://access.redhat.com/security/cve/CVE-2022-32213
-
advisory
https://www.cve.org/CVERecord?id=CVE-2022-32213
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-32213
-
report
https://access.redhat.com/security/cve/CVE-2022-32214
-
advisory
https://www.cve.org/CVERecord?id=CVE-2022-32214
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-32214
-
report
https://access.redhat.com/security/cve/CVE-2022-32215
-
advisory
https://www.cve.org/CVERecord?id=CVE-2022-32215
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-32215
-
report
https://access.redhat.com/security/cve/CVE-2022-33987
-
advisory
https://www.cve.org/CVERecord?id=CVE-2022-33987
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-33987
-
article
https://github.com/sindresorhus/got/pull/2047
-
article
https://github.com/sindresorhus/got/releases/tag/v11.8.5