Red Hat Security Advisory: rh-nodejs14-nodejs security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 5

• High 8.6
  CVE-2022-4904

  A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…

  nodejs c-ares grpc c-ares Debian Ubuntu Azure Linux
  Mar 6, 2023
• High 7.5
  CVE-2022-38900 EPSS 23%

  decode-uri-component vulnerable to Denial of Service (DoS)

  decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

  js-jquery decode-uri-component Azure Linux npm
  Nov 28, 2022
• High 7.5
  CVE-2023-23918

  A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible t…

  Node.js node nodejs nodejs Debian Azure Linux Alpine
  Feb 23, 2023
• Medium 5.3
  CVE-2022-25881

  http-cache-semantics vulnerable to Regular Expression Denial of Service

  This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

  nodejs nodejs-nodemon http-cache-semantics org.webjars.npm:http-cache-semantics Azure Linux npm Maven
  Jan 31, 2023
• Medium 4.2
  CVE-2023-23920

  An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Feb 23, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153715
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2165824
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2168631
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170644
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2171935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2172217
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1744.json
• report
  https://access.redhat.com/security/cve/CVE-2022-4904
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-4904
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-4904
• article
  https://github.com/c-ares/c-ares/issues/496
• report
  https://access.redhat.com/security/cve/CVE-2022-25881
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25881
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25881
• report
  https://access.redhat.com/security/cve/CVE-2022-38900
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-38900
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-38900
• article
  https://github.com/SamVerschueren/decode-uri-component/issues/5
• advisory
  https://github.com/advisories/GHSA-w573-4hg7-7wgq
• report
  https://access.redhat.com/security/cve/CVE-2023-23918
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-23918
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-23918
• report
  https://access.redhat.com/security/cve/CVE-2023-23920
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-23920
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-23920