Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 8

• Critical 9.8
  CVE-2023-32002

  The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition f…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 21, 2023
• High 8.8
  CVE-2023-32006

  The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the poli…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 15, 2023
• High 7.5
  CVE-2023-30581

  The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outs…

  Node.js node nodejs nodejs-20 Debian Wolfi
  Nov 22, 2023
• High 7.5
  CVE-2023-30589

  llhttp vulnerable to HTTP request smuggling

  The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…

  Node.js node openjdk17 nodejs Debian Azure Linux Alpine Wolfi npm
  Jun 30, 2023
• High 7.5
  CVE-2023-32559

  A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 24, 2023
• Medium 5.3
  CVE-2022-25883

  semver vulnerable to Regular Expression Denial of Service

  Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

  nodejs js-jquery nodejs18 nodejs-nodemon Debian Ubuntu Azure Linux npm
  Jun 21, 2023
• Unscored —
  CVE-2023-30588

  When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect te…

  Node.js node nodejs nodejs-20 Debian Wolfi
  Nov 28, 2023
• Unscored —
  CVE-2023-30590

  The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, t…

  Node.js node nodejs nodejs Debian Ubuntu Wolfi
  Nov 28, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2216475
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2219824
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2219838
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2219841
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2219842
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2223679
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230948
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230955
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230956
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2233892
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237395
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5361.json
• report
  https://access.redhat.com/security/cve/CVE-2022-25883
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25883
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25883
• advisory
  https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
• article
  https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
• report
  https://access.redhat.com/security/cve/CVE-2023-30581
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-30581
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-30581
• report
  https://access.redhat.com/security/cve/CVE-2023-30588
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-30588
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-30588
• report
  https://access.redhat.com/security/cve/CVE-2023-30589
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-30589
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-30589
• report
  https://access.redhat.com/security/cve/CVE-2023-30590
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-30590
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-30590
• report
  https://access.redhat.com/security/cve/CVE-2023-32002
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32002
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32002
• article
  https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002
• report
  https://access.redhat.com/security/cve/CVE-2023-32006
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32006
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32006
• article
  https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006
• report
  https://access.redhat.com/security/cve/CVE-2023-32559