Red Hat Security Advisory: nodejs:16 security and bug fix update

Fixed packages 9

Vulnerabilities 6

• Critical 9.1
  CVE-2022-32213 EPSS 45%

  llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm
  Jul 14, 2022
• Critical 9.1
  CVE-2022-32214 EPSS 82%

  llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm
  Jul 14, 2022
• High 7.5
  CVE-2021-3807

  Inefficient Regular Expression Complexity in chalk/ansi-regex

  ansi-regex is vulnerable to Inefficient Regular Expression Complexity

  chalk chalk/ansi-regex node-ansi-regex ansi-regex Debian Ubuntu npm
  Sep 17, 2021
• Medium 5.3
  CVE-2022-33987

  Got allows a redirect to a UNIX socket

  The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

  node-got node-got got Debian Ubuntu npm
  Jun 18, 2022
• Unscored —
  CVE-2022-32212

  A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAl…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jul 14, 2022
• Unscored —
  CVE-2022-32215 EPSS 70%

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine
  Jul 14, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2007557
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2102001
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2105422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2105426
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2105428
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2105430
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2106369
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6449.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3807
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3807
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3807
• article
  https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
• report
  https://access.redhat.com/security/cve/CVE-2022-32212
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32212
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32212
• article
  https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2022-32213
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32213
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32213
• report
  https://access.redhat.com/security/cve/CVE-2022-32214
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32214
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32214
• report
  https://access.redhat.com/security/cve/CVE-2022-32215
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32215
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32215
• report
  https://access.redhat.com/security/cve/CVE-2022-33987
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-33987
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-33987
• article
  https://github.com/sindresorhus/got/pull/2047
• article
  https://github.com/sindresorhus/got/releases/tag/v11.8.5