Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 4

• Critical 9.8
  CVE-2021-44906 Public exploit

  Prototype Pollution in minimist

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  js-jquery minimist node-minimist node-minimist Debian Ubuntu Azure Linux npm
  Mar 17, 2022
• High 8.1
  CVE-2022-43548 EPSS 15%

  A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insuffi…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Dec 5, 2022
• High 7.5
  CVE-2022-3517

  minimatch ReDoS vulnerability

  A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

  js-jquery nodejs-nodemon node-minimatch minimatch Debian Ubuntu Azure Linux npm
  Oct 17, 2022
• Medium 6.5
  CVE-2022-35256

  The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 5, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2130518
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134609
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140911
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142808
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0321.json
• report
  https://access.redhat.com/security/cve/CVE-2021-44906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44906
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44906
• advisory
  https://github.com/advisories/GHSA-xvch-5gv4-984h
• report
  https://access.redhat.com/security/cve/CVE-2022-3517
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3517
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3517
• report
  https://access.redhat.com/security/cve/CVE-2022-35256
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-35256
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-35256
• article
  https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256
• report
  https://access.redhat.com/security/cve/CVE-2022-43548
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-43548
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-43548
• article
  https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548