Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 7

• Critical 9.8
  CVE-2021-44906 Public exploit

  Prototype Pollution in minimist

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  js-jquery node-minimist minimist node-minimist Debian Ubuntu Azure Linux npm
  Mar 17, 2022
• High 8.1
  CVE-2022-43548 EPSS 15%

  A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insuffi…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Dec 5, 2022
• High 7.5
  CVE-2022-3517

  minimatch ReDoS vulnerability

  A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

  js-jquery nodejs-nodemon minimatch node-minimatch Debian Ubuntu Azure Linux npm
  Oct 17, 2022
• Unscored —
  CVE-2021-44531

  Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN …

  Node.js node openjdk11 nodejs Debian Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2021-44532 EPSS 10%

  Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It …

  Node.js node nodejs openjdk11 Debian Ubuntu Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2021-44533

  Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly…

  Node.js node nodejs openjdk11 Debian Ubuntu Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2022-21824 EPSS 22%

  Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be pass…

  Node.js node openjdk11 nodejs Debian Azure Linux Alpine
  Feb 24, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040846
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134609
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140911
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142806
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_9073.json
• report
  https://access.redhat.com/security/cve/CVE-2021-44531
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44531
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44531
• article
  https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-44532
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44532
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44532
• report
  https://access.redhat.com/security/cve/CVE-2021-44533
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44533
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44533
• report
  https://access.redhat.com/security/cve/CVE-2021-44906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44906
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44906
• advisory
  https://github.com/advisories/GHSA-xvch-5gv4-984h
• report
  https://access.redhat.com/security/cve/CVE-2022-3517
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3517
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3517
• report
  https://access.redhat.com/security/cve/CVE-2022-21824
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-21824
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-21824
• report
  https://access.redhat.com/security/cve/CVE-2022-43548
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-43548
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-43548
• article
  https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548