[ALSA-2021:3623] nodejs:12 security and bug fix update
An update for the nodejs:12 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)
nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)
c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)
nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)
nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)
nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)
nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)
nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)
- ID
- ALSA-2021:3623
- Severity
- important
- URL
- https://errata.almalinux.org/ALSA-2021:3623.html
- Published
-
2021-09-21T12:33:58
(3 years ago) - Modified
-
2021-09-21T12:33:58
(3 years ago) - Rights
- Copyright 2022 AlmaLinux OS
- Other Advisories
-
- ALAS-2021-1545
- ALAS2-2024-2399
- ALPINE:CVE-2021-22930
- ALPINE:CVE-2021-22931
- ALPINE:CVE-2021-22939
- ALPINE:CVE-2021-3672
- ALSA-2021:3666
- ALSA-2022:2043
- ASA-202108-1
- ASA-202108-13
- DSA-4954-1
- ELSA-2021-3623
- ELSA-2021-3666
- ELSA-2022-2043
- FEDORA-2021-001ec24fc5
- FEDORA-2021-0a60cbb948
- FEDORA-2021-52c89b44a9
- FEDORA-2021-a48cf28c13
- FEDORA-2021-c83b66abdb
- FREEBSD:43E9FFD4-D6E0-11ED-956F-7054D21A9E2A
- FREEBSD:7062BCE0-1B17-11EC-9D9D-0022489AD614
- FREEBSD:B092BD4F-1B16-11EC-9D9D-0022489AD614
- FREEBSD:C9387E4D-2F5F-11EC-8BE6-D4C9EF517024
- FREEBSD:F53DAB71-1B15-11EC-9D9D-0022489AD614
- GLSA-202401-02
- GLSA-202405-29
- MS:CVE-2021-22930
- MS:CVE-2021-3672
- NPM:GHSA-3JFQ-G458-7QM9
- NPM:GHSA-HJ48-42VR-X3V9
- NPM:GHSA-R628-MHMH-QJHW
- openSUSE-SU-2021:1168-1
- openSUSE-SU-2021:1214-1
- openSUSE-SU-2021:1239-1
- openSUSE-SU-2021:1313-1
- openSUSE-SU-2021:1343-1
- openSUSE-SU-2021:2760-1
- openSUSE-SU-2021:2875-1
- openSUSE-SU-2021:2953-1
- openSUSE-SU-2021:3211-1
- openSUSE-SU-2021:3294-1
- openSUSE-SU-2022:0657-1
- openSUSE-SU-2022:0704-1
- openSUSE-SU-2022:0715-1
- RHSA-2021:3623
- RHSA-2021:3666
- RHSA-2022:2043
- RLSA-2021:3623
- RLSA-2021:3666
- RLSA-2022:2043
- SUSE-SU-2021:2690-1
- SUSE-SU-2021:2760-1
- SUSE-SU-2021:2790-1
- SUSE-SU-2021:2823-1
- SUSE-SU-2021:2824-1
- SUSE-SU-2021:2875-1
- SUSE-SU-2021:2953-1
- SUSE-SU-2021:3184-1
- SUSE-SU-2021:3211-1
- SUSE-SU-2021:3294-1
- SUSE-SU-2022:0531-1
- SUSE-SU-2022:0563-1
- SUSE-SU-2022:0569-1
- SUSE-SU-2022:0570-1
- SUSE-SU-2022:0657-1
- SUSE-SU-2022:0704-1
- SUSE-SU-2022:0715-1
- SUSE-SU-2022:1717-1
- SUSE-SU-2022:2855-1
- USN-5034-1
- USN-5034-2
- USN-5283-1
Source | # ID | Name | URL |
---|---|---|---|
Self | ALSA-2021-3623 | https://errata.almalinux.org/8/ALSA-2021-3623.html | |
CVE | CVE-2021-22930 | https://vulners.com/cve/CVE-2021-22930 | |
CVE | CVE-2021-22931 | https://vulners.com/cve/CVE-2021-22931 | |
CVE | CVE-2021-22939 | https://vulners.com/cve/CVE-2021-22939 | |
CVE | CVE-2021-22940 | https://vulners.com/cve/CVE-2021-22940 | |
CVE | CVE-2021-23343 | https://vulners.com/cve/CVE-2021-23343 | |
CVE | CVE-2021-32803 | https://vulners.com/cve/CVE-2021-32803 | |
CVE | CVE-2021-32804 | https://vulners.com/cve/CVE-2021-32804 | |
CVE | CVE-2021-3672 | https://vulners.com/cve/CVE-2021-3672 |
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/almalinux/npm?arch=x86_64&distro=almalinux-8.4 | almalinux | npm | < 6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7 | almalinux-8.4 | x86_64 | |
Affected | pkg:rpm/almalinux/npm?arch=aarch64&distro=almalinux-8.4 | almalinux | npm | < 6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7 | almalinux-8.4 | aarch64 | |
Affected | pkg:rpm/almalinux/nodejs?arch=x86_64&distro=almalinux-8.4 | almalinux | nodejs | < 12.22.5-1.module_el8.4.0+2529+af52a4c7 | almalinux-8.4 | x86_64 | |
Affected | pkg:rpm/almalinux/nodejs?arch=aarch64&distro=almalinux-8.4 | almalinux | nodejs | < 12.22.5-1.module_el8.4.0+2529+af52a4c7 | almalinux-8.4 | aarch64 | |
Affected | pkg:rpm/almalinux/nodejs-packaging?arch=noarch&distro=almalinux-8.4 | almalinux | nodejs-packaging | < 17-3.module_el8.4.0+2224+b07ac28e | almalinux-8.4 | noarch | |
Affected | pkg:rpm/almalinux/nodejs-packaging?arch=noarch&distro=almalinux-8.3 | almalinux | nodejs-packaging | < 17-3.module_el8.3.0+2023+d2377ea3 | almalinux-8.3 | noarch | |
Affected | pkg:rpm/almalinux/nodejs-nodemon?arch=noarch&distro=almalinux-8.4 | almalinux | nodejs-nodemon | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | almalinux-8.4 | noarch | |
Affected | pkg:rpm/almalinux/nodejs-full-i18n?arch=x86_64&distro=almalinux-8.4 | almalinux | nodejs-full-i18n | < 12.22.5-1.module_el8.4.0+2529+af52a4c7 | almalinux-8.4 | x86_64 | |
Affected | pkg:rpm/almalinux/nodejs-full-i18n?arch=aarch64&distro=almalinux-8.4 | almalinux | nodejs-full-i18n | < 12.22.5-1.module_el8.4.0+2529+af52a4c7 | almalinux-8.4 | aarch64 | |
Affected | pkg:rpm/almalinux/nodejs-docs?arch=noarch&distro=almalinux-8.4 | almalinux | nodejs-docs | < 12.22.5-1.module_el8.4.0+2529+af52a4c7 | almalinux-8.4 | noarch | |
Affected | pkg:rpm/almalinux/nodejs-devel?arch=x86_64&distro=almalinux-8.4 | almalinux | nodejs-devel | < 12.22.5-1.module_el8.4.0+2529+af52a4c7 | almalinux-8.4 | x86_64 | |
Affected | pkg:rpm/almalinux/nodejs-devel?arch=aarch64&distro=almalinux-8.4 | almalinux | nodejs-devel | < 12.22.5-1.module_el8.4.0+2529+af52a4c7 | almalinux-8.4 | aarch64 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |