Red Hat Security Advisory: nodejs:20 security update

Fixed packages 10

Vulnerabilities 6

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• High 7.7
  CVE-2023-39331

  A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traver…

  Node.js node nodejs-current nodejs-20 Alpine Wolfi
  Oct 18, 2023
• Medium 5.3
  CVE-2023-39333

  Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Sep 7, 2024
• Low 3.9
  CVE-2023-45143

  Undici's cookie header not cleared on cross-origin redirect in fetch

  Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disa…

  Node.js undici nodejs openjdk21 Debian Ubuntu Azure Linux Alpine npm
  Oct 12, 2023
• Unscored —
  CVE-2023-38552

  When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can inte…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 18, 2023
• Unscored —
  CVE-2023-39332

  Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, …

  Node.js node nodejs-current nodejs-20 Alpine Wolfi
  Oct 18, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242803
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2244104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2244413
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2244414
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2244415
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2244418
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7205.json
• report
  https://access.redhat.com/security/cve/CVE-2023-38552
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-38552
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-38552
• report
  https://access.redhat.com/security/cve/CVE-2023-39331
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39331
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39331
• report
  https://access.redhat.com/security/cve/CVE-2023-39332
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39332
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39332
• report
  https://access.redhat.com/security/cve/CVE-2023-39333
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39333
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39333
• report
  https://access.redhat.com/security/cve/CVE-2023-44487
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-44487
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-44487
• article
  https://github.com/dotnet/announcements/issues/277
• advisory
  https://pkg.go.dev/vuln/GO-2023-2102
• article
  https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
• article
  https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2023-45143
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45143
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45143
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g