Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 11

• Critical 9.8
  CVE-2021-44906 Public exploit

  Prototype Pollution in minimist

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  js-jquery minimist node-minimist node-minimist Debian Ubuntu Azure Linux npm
  Mar 17, 2022
• High 8.6
  CVE-2022-4904

  A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…

  nodejs c-ares grpc c-ares Debian Ubuntu Azure Linux
  Mar 6, 2023
• High 8.1
  CVE-2022-43548 EPSS 15%

  A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insuffi…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Dec 5, 2022
• High 7.5
  CVE-2021-35065

  glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service

  The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

  glob-parent node-glob-parent node-glob-parent Debian Ubuntu npm
  Dec 26, 2022
• High 7.5
  CVE-2022-24999 Public exploit EPSS 16%

  qs vulnerable to Prototype Pollution

  qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pl…

  js-jquery nodejs-nodemon qs node-qs Debian Ubuntu Azure Linux npm
  Nov 26, 2022
• High 7.5
  CVE-2022-3517

  minimatch ReDoS vulnerability

  A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

  js-jquery nodejs-nodemon minimatch node-minimatch Debian Ubuntu Azure Linux npm
  Oct 17, 2022
• High 7.5
  CVE-2022-38900 EPSS 23%

  decode-uri-component vulnerable to Denial of Service (DoS)

  decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

  js-jquery decode-uri-component Azure Linux npm
  Nov 28, 2022
• High 7.5
  CVE-2023-23918

  A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible t…

  Node.js node nodejs nodejs Debian Azure Linux Alpine
  Feb 23, 2023
• Medium 6.5
  CVE-2022-35256

  The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 5, 2022
• Medium 5.3
  CVE-2022-25881

  http-cache-semantics vulnerable to Regular Expression Denial of Service

  This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

  nodejs nodejs-nodemon org.webjars.npm:http-cache-semantics http-cache-semantics Azure Linux npm Maven
  Jan 31, 2023
• Medium 4.2
  CVE-2023-23920

  An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Feb 23, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2130518
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134609
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140911
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142823
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150323
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156324
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2165824
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2168631
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170644
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2171935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2172217
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2175828
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1533.json
• report
  https://access.redhat.com/security/cve/CVE-2021-35065
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-35065
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-35065
• article
  https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
• report
  https://access.redhat.com/security/cve/CVE-2021-44906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44906
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44906
• advisory
  https://github.com/advisories/GHSA-xvch-5gv4-984h
• report
  https://access.redhat.com/security/cve/CVE-2022-3517
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3517
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3517
• report
  https://access.redhat.com/security/cve/CVE-2022-4904
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-4904
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-4904
• article
  https://github.com/c-ares/c-ares/issues/496
• report
  https://access.redhat.com/security/cve/CVE-2022-24999
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-24999
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-24999
• article
  https://github.com/expressjs/express/releases/tag/4.17.3
• article
  https://github.com/ljharb/qs/pull/428
• article
  https://github.com/n8tz/CVE-2022-24999
• report
  https://access.redhat.com/security/cve/CVE-2022-25881
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25881
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25881