RHSA-2023:1743 — Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Fixed packages 9

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	nodejs	1:14.21.3-1.module+el8.7.0+18531+81d21ca6
Red Hat · RHEL 8 enterprise_linux:8::appstream	nodejs-debuginfo	1:14.21.3-1.module+el8.7.0+18531+81d21ca6
Red Hat · RHEL 8 enterprise_linux:8::appstream	nodejs-debugsource	1:14.21.3-1.module+el8.7.0+18531+81d21ca6
Red Hat · RHEL 8 enterprise_linux:8::appstream	nodejs-devel	1:14.21.3-1.module+el8.7.0+18531+81d21ca6
Red Hat · RHEL 8 enterprise_linux:8::appstream	nodejs-docs	1:14.21.3-1.module+el8.7.0+18531+81d21ca6
Red Hat · RHEL 8 enterprise_linux:8::appstream	nodejs-full-i18n	1:14.21.3-1.module+el8.7.0+18531+81d21ca6
Red Hat · RHEL 8 enterprise_linux:8::appstream	nodejs-nodemon	0:2.0.20-3.module+el8.7.0+18531+81d21ca6
Red Hat · RHEL 8 enterprise_linux:8::appstream	nodejs-packaging	0:23-3.module+el8.3.0+6519+9f98ed83
Red Hat · RHEL 8 enterprise_linux:8::appstream	npm	1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6

Vulnerabilities 7

High 8.6

CVE-2022-4904

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…

nodejs c-ares grpc c-ares Debian Ubuntu Azure Linux

Mar 6, 2023
High 7.5

CVE-2021-35065

glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

glob-parent node-glob-parent node-glob-parent Debian Ubuntu npm

Dec 26, 2022
High 7.5

CVE-2022-3517

minimatch ReDoS vulnerability

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

js-jquery nodejs-nodemon minimatch node-minimatch Debian Ubuntu Azure Linux npm

Oct 17, 2022
High 7.5

CVE-2022-38900 EPSS 23%

decode-uri-component vulnerable to Denial of Service (DoS)

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

js-jquery decode-uri-component Azure Linux npm

Nov 28, 2022
High 7.5

CVE-2023-23918

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible t…

Node.js node nodejs nodejs Debian Azure Linux Alpine

Feb 23, 2023
Medium 5.3

CVE-2022-25881

http-cache-semantics vulnerable to Regular Expression Denial of Service

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

nodejs nodejs-nodemon org.webjars.npm:http-cache-semantics http-cache-semantics Azure Linux npm Maven

Jan 31, 2023
Medium 4.2

CVE-2023-23920

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…

Node.js node nodejs nodejs Debian Ubuntu Alpine

Feb 23, 2023

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2134609
report
https://bugzilla.redhat.com/show_bug.cgi?id=2156324
report
https://bugzilla.redhat.com/show_bug.cgi?id=2165824
report
https://bugzilla.redhat.com/show_bug.cgi?id=2168631
report
https://bugzilla.redhat.com/show_bug.cgi?id=2170644
report
https://bugzilla.redhat.com/show_bug.cgi?id=2171935
report
https://bugzilla.redhat.com/show_bug.cgi?id=2172217
report
https://bugzilla.redhat.com/show_bug.cgi?id=2175826
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1743.json
report
https://access.redhat.com/security/cve/CVE-2021-35065
advisory
https://www.cve.org/CVERecord?id=CVE-2021-35065
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-35065
article
https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
report
https://access.redhat.com/security/cve/CVE-2022-3517
advisory
https://www.cve.org/CVERecord?id=CVE-2022-3517
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3517
report
https://access.redhat.com/security/cve/CVE-2022-4904
advisory
https://www.cve.org/CVERecord?id=CVE-2022-4904
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4904
article
https://github.com/c-ares/c-ares/issues/496
report
https://access.redhat.com/security/cve/CVE-2022-25881
advisory
https://www.cve.org/CVERecord?id=CVE-2022-25881
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25881
report
https://access.redhat.com/security/cve/CVE-2022-38900
advisory
https://www.cve.org/CVERecord?id=CVE-2022-38900
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-38900
article
https://github.com/SamVerschueren/decode-uri-component/issues/5
advisory
https://github.com/advisories/GHSA-w573-4hg7-7wgq
report
https://access.redhat.com/security/cve/CVE-2023-23918
advisory
https://www.cve.org/CVERecord?id=CVE-2023-23918
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-23918
report
https://access.redhat.com/security/cve/CVE-2023-23920
advisory
https://www.cve.org/CVERecord?id=CVE-2023-23920
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-23920

Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 7

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…

glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service

minimatch ReDoS vulnerability

decode-uri-component vulnerable to Denial of Service (DoS)

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible t…

http-cache-semantics vulnerable to Regular Expression Denial of Service

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…

References