Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2223313, BZ#2234404)
Security Fix(es):
* nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)
* nodejs-semver: Regular expression denial of service (CVE-2022-25883)
* nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006)
* nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux · 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d |
| Rocky Linux · 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d |
| Rocky Linux · 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b |
| Rocky Linux · 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 |
| Rocky Linux · 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 |
Vulnerabilities 4
-
Critical 9.8
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition f…
-
High 8.8
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the poli…
-
High 7.5
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.…
-
Medium 5.3
semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2216475
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2223313
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2230948
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2230955
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2230956
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2234404