Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debuginfo | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debugsource | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-devel | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-docs | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-full-i18n | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-nodemon | 0:2.0.20-3.module+el8.8.0+19038+6f60344f |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-packaging | 0:25-1.module+el8.5.0+10992+fac5fe06 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | npm | 1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5 |
Vulnerabilities 4
-
High 7.5
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outs…
-
High 7.5
llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…
-
Unscored —
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect te…
-
Unscored —
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, t…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2219824
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2219838
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2219841
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2219842
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2223678
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2223688
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4537.json
-
report
https://access.redhat.com/security/cve/CVE-2023-30581
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-30581
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-30581
-
report
https://access.redhat.com/security/cve/CVE-2023-30588
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-30588
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-30588
-
report
https://access.redhat.com/security/cve/CVE-2023-30589
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-30589
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-30589
-
report
https://access.redhat.com/security/cve/CVE-2023-30590
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-30590
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-30590