Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update

Fixed packages 9

Vulnerabilities 10

• Critical 9.1
  CVE-2022-32213 EPSS 45%

  llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm
  Jul 14, 2022
• Critical 9.1
  CVE-2022-32214 EPSS 82%

  llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm
  Jul 14, 2022
• High 7.5
  CVE-2021-33502

  ReDoS in normalize-url

  The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

  nodejs-nodemon node-yarnpkg node-got node-got Debian Ubuntu Azure Linux npm
  May 24, 2021
• High 7.5
  CVE-2021-3807

  Inefficient Regular Expression Complexity in chalk/ansi-regex

  ansi-regex is vulnerable to Inefficient Regular Expression Complexity

  chalk chalk/ansi-regex node-ansi-regex ansi-regex Debian Ubuntu npm
  Sep 17, 2021
• High 7.5
  CVE-2022-29244

  npm packing does not respect root-level ignore files in workspaces

  npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7…

  npm npm npm npm Ubuntu npm
  Jun 13, 2022
• High 7.3
  CVE-2020-7788

  Prototype Pollution

  This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

  js-jquery nodejs-nodemon ini node-ini Debian Ubuntu Azure Linux npm
  Dec 11, 2020
• Medium 5.3
  CVE-2020-28469

  Regular Expression Denial of Service (ReDoS)

  This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

  js-jquery nodejs-nodemon glob-parent node-glob-parent Debian Azure Linux npm
  Jun 3, 2021
• Medium 5.3
  CVE-2022-33987

  Got allows a redirect to a UNIX socket

  The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

  node-got node-got got Debian Ubuntu npm
  Jun 18, 2022
• Unscored —
  CVE-2022-32212

  A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAl…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jul 14, 2022
• Unscored —
  CVE-2022-32215 EPSS 70%

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine
  Jul 14, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1907444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1945459
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1964461
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2007557
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2098556
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2102001
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2105422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2105426
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2105428
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2105430
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2121019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124299
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6595.json
• report
  https://access.redhat.com/security/cve/CVE-2020-7788
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7788
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7788
• report
  https://access.redhat.com/security/cve/CVE-2020-28469
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28469
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28469
• article
  https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
• report
  https://access.redhat.com/security/cve/CVE-2021-3807
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3807
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3807
• article
  https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
• report
  https://access.redhat.com/security/cve/CVE-2021-33502
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33502
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33502
• article
  https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539
• report
  https://access.redhat.com/security/cve/CVE-2022-29244
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29244
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29244
• article
  https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
• report
  https://access.redhat.com/security/cve/CVE-2022-32212
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32212
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32212
• article
  https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2022-32213
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32213