Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 7

• High 8.6
  CVE-2022-4904

  A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…

  nodejs c-ares grpc c-ares Debian Ubuntu Azure Linux
  Mar 6, 2023
• High 7.5
  CVE-2021-35065

  glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service

  The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

  glob-parent node-glob-parent node-glob-parent Debian Ubuntu npm
  Dec 26, 2022
• High 7.5
  CVE-2023-23918

  A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible t…

  Node.js node nodejs nodejs Debian Azure Linux Alpine
  Feb 23, 2023
• High 7.5
  CVE-2023-24807

  Undici vulnerable to Regular Expression Denial of Service in Headers

  Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to th…

  Node.js undici nodejs nodejs Debian Azure Linux Alpine npm
  Feb 16, 2023
• Medium 6.5
  CVE-2023-23936

  CRLF Injection in Nodejs ‘undici’ via host

  Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize t…

  Node.js undici nodejs nodejs Debian Azure Linux Alpine npm
  Feb 16, 2023
• Medium 5.3
  CVE-2022-25881

  http-cache-semantics vulnerable to Regular Expression Denial of Service

  This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

  nodejs nodejs-nodemon org.webjars.npm:http-cache-semantics http-cache-semantics Azure Linux npm Maven
  Jan 31, 2023
• Medium 4.2
  CVE-2023-23920

  An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Feb 23, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2165824
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2168631
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2171935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2172190
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2172204
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2172217
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178076
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2655.json
• report
  https://access.redhat.com/security/cve/CVE-2021-35065
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156324
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-35065
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-35065
• article
  https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
• report
  https://access.redhat.com/security/cve/CVE-2022-4904
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-4904
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-4904
• article
  https://github.com/c-ares/c-ares/issues/496
• report
  https://access.redhat.com/security/cve/CVE-2022-25881
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25881
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25881
• report
  https://access.redhat.com/security/cve/CVE-2023-23918
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-23918
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-23918
• report
  https://access.redhat.com/security/cve/CVE-2023-23920
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-23920
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-23920
• report
  https://access.redhat.com/security/cve/CVE-2023-23936
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-23936
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-23936
• report
  https://access.redhat.com/security/cve/CVE-2023-24807
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24807
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24807