Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs | 1:16.20.2-2.module+el8.8.0+19898+ab99ba34 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debuginfo | 1:16.20.2-2.module+el8.8.0+19898+ab99ba34 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-debugsource | 1:16.20.2-2.module+el8.8.0+19898+ab99ba34 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-devel | 1:16.20.2-2.module+el8.8.0+19898+ab99ba34 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-docs | 1:16.20.2-2.module+el8.8.0+19898+ab99ba34 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-full-i18n | 1:16.20.2-2.module+el8.8.0+19898+ab99ba34 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+19764+7eed1ca3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | nodejs-packaging | 0:26-1.module+el8.8.0+19857+6d2a104d |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | npm | 1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34 |
Vulnerabilities 4
-
Critical 9.8
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition f…
-
High 8.8
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the poli…
-
High 7.5
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.…
-
Medium 5.3
semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2216475
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2230948
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2230955
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2230956
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2233891
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237394
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5360.json
-
report
https://access.redhat.com/security/cve/CVE-2022-25883
-
advisory
https://www.cve.org/CVERecord?id=CVE-2022-25883
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25883
-
advisory
https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
-
article
https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
-
report
https://access.redhat.com/security/cve/CVE-2023-32002
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-32002
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-32002
-
article
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002
-
report
https://access.redhat.com/security/cve/CVE-2023-32006
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-32006
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-32006
-
article
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006
-
report
https://access.redhat.com/security/cve/CVE-2023-32559
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-32559
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-32559
-
article
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-processbinding-mediumcve-2023-32559