Red Hat Security Advisory: rh-nodejs14-nodejs security update

Fixed packages 5

Vulnerabilities 6

• Critical 9.8
  CVE-2021-44906 Public exploit

  Prototype Pollution in minimist

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  js-jquery node-minimist minimist node-minimist Debian Ubuntu Azure Linux npm
  Mar 17, 2022
• Medium 6.5
  CVE-2022-35256

  The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 5, 2022
• Unscored —
  CVE-2021-44531

  Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN …

  Node.js node openjdk11 nodejs Debian Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2021-44532 EPSS 10%

  Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It …

  Node.js node nodejs openjdk11 Debian Ubuntu Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2021-44533

  Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly…

  Node.js node nodejs openjdk11 Debian Ubuntu Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2022-21824 EPSS 22%

  Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be pass…

  Node.js node openjdk11 nodejs Debian Azure Linux Alpine
  Feb 24, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040846
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2130518
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7044.json
• report
  https://access.redhat.com/security/cve/CVE-2021-44531
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44531
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44531
• article
  https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-44532
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44532
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44532
• report
  https://access.redhat.com/security/cve/CVE-2021-44533
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44533
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44533
• report
  https://access.redhat.com/security/cve/CVE-2021-44906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44906
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44906
• advisory
  https://github.com/advisories/GHSA-xvch-5gv4-984h
• report
  https://access.redhat.com/security/cve/CVE-2022-21824
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-21824
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-21824
• report
  https://access.redhat.com/security/cve/CVE-2022-35256
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-35256
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-35256
• article
  https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256