Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 5

• Critical 9.8
  CVE-2021-44906 Public exploit

  Prototype Pollution in minimist

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  js-jquery minimist node-minimist node-minimist Debian Ubuntu Azure Linux npm
  Mar 17, 2022
• High 8.8
  CVE-2022-0235

  Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

  node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

  node-fetch node-fetch/node-fetch node-fetch node-fetch Debian Ubuntu npm
  Jan 16, 2022
• High 8.1
  CVE-2022-43548 EPSS 15%

  A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insuffi…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Dec 5, 2022
• High 7.5
  CVE-2022-24999 Public exploit EPSS 16%

  qs vulnerable to Prototype Pollution

  qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pl…

  js-jquery nodejs-nodemon node-qs node-qs Debian Ubuntu Azure Linux npm
  Nov 26, 2022
• High 7.5
  CVE-2022-3517

  minimatch ReDoS vulnerability

  A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

  js-jquery nodejs-nodemon node-minimatch minimatch Debian Ubuntu Azure Linux npm
  Oct 17, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044591
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134609
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140911
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142821
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150323
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0050.json
• report
  https://access.redhat.com/security/cve/CVE-2021-44906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44906
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44906
• advisory
  https://github.com/advisories/GHSA-xvch-5gv4-984h
• report
  https://access.redhat.com/security/cve/CVE-2022-0235
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-0235
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-0235
• article
  https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/
• report
  https://access.redhat.com/security/cve/CVE-2022-3517
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3517
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3517
• report
  https://access.redhat.com/security/cve/CVE-2022-24999
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-24999
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-24999
• article
  https://github.com/expressjs/express/releases/tag/4.17.3
• article
  https://github.com/ljharb/qs/pull/428
• article
  https://github.com/n8tz/CVE-2022-24999
• report
  https://access.redhat.com/security/cve/CVE-2022-43548
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-43548
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-43548
• article
  https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548