Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 16

• Critical 9.8
  CVE-2021-44906 Public exploit

  Prototype Pollution in minimist

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  js-jquery node-minimist minimist node-minimist Debian Ubuntu Azure Linux npm
  Mar 17, 2022
• High 8.8
  CVE-2022-0235

  Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

  node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

  node-fetch node-fetch/node-fetch node-fetch node-fetch Debian Ubuntu npm
  Jan 16, 2022
• High 8.6
  CVE-2022-4904

  A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…

  nodejs c-ares grpc c-ares Debian Ubuntu Azure Linux
  Mar 6, 2023
• High 8.1
  CVE-2022-43548 EPSS 15%

  A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insuffi…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Dec 5, 2022
• High 7.5
  CVE-2021-35065

  glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service

  The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

  glob-parent node-glob-parent node-glob-parent Debian Ubuntu npm
  Dec 26, 2022
• High 7.5
  CVE-2022-24999 Public exploit EPSS 16%

  qs vulnerable to Prototype Pollution

  qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pl…

  js-jquery nodejs-nodemon node-qs node-qs Debian Ubuntu Azure Linux npm
  Nov 26, 2022
• High 7.5
  CVE-2022-3517

  minimatch ReDoS vulnerability

  A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

  js-jquery nodejs-nodemon node-minimatch node-minimatch Debian Ubuntu Azure Linux npm
  Oct 17, 2022
• High 7.5
  CVE-2022-38900 EPSS 23%

  decode-uri-component vulnerable to Denial of Service (DoS)

  decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

  js-jquery decode-uri-component Azure Linux npm
  Nov 28, 2022
• High 7.5
  CVE-2023-23918

  A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible t…

  Node.js node nodejs nodejs Debian Azure Linux Alpine
  Feb 23, 2023
• Medium 6.5
  CVE-2022-35256

  The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 5, 2022
• Medium 5.3
  CVE-2022-25881

  http-cache-semantics vulnerable to Regular Expression Denial of Service

  This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

  nodejs nodejs-nodemon org.webjars.npm:http-cache-semantics http-cache-semantics Azure Linux npm Maven
  Jan 31, 2023
• Medium 4.2
  CVE-2023-23920

  An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Feb 23, 2023
• Unscored —
  CVE-2021-44531

  Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN …

  Node.js node openjdk11 nodejs Debian Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2021-44532 EPSS 10%

  Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It …

  Node.js node nodejs openjdk11 Debian Ubuntu Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2021-44533

  Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly…

  Node.js node nodejs openjdk11 Debian Ubuntu Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2022-21824 EPSS 22%

  Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be pass…

  Node.js node openjdk11 nodejs Debian Azure Linux Alpine
  Feb 24, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040846
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044591
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2130518
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134609
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140911
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150323
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156324
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2165824
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2168631
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170644
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2171935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2172217
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2175827
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1742.json
• report
  https://access.redhat.com/security/cve/CVE-2021-35065
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-35065
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-35065
• article
  https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
• report
  https://access.redhat.com/security/cve/CVE-2021-44531
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44531
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44531
• article
  https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2021-44532
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44532
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44532
• report
  https://access.redhat.com/security/cve/CVE-2021-44533
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44533
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44533
• report
  https://access.redhat.com/security/cve/CVE-2021-44906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44906
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44906
• advisory
  https://github.com/advisories/GHSA-xvch-5gv4-984h
• report
  https://access.redhat.com/security/cve/CVE-2022-0235