[ALSA-2023:1582] nodejs:16 security, bug fix, and enhancement update

Severity Moderate

Affected Packages 11

CVEs 8

nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package	Affected Version
pkg:rpm/almalinux/npm?arch=x86_64&distro=almalinux-8.7	< 8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324
pkg:rpm/almalinux/npm?arch=aarch64&distro=almalinux-8.7	< 8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324
pkg:rpm/almalinux/nodejs?arch=x86_64&distro=almalinux-8.7	< 16.19.1-1.module_el8.7.0+3496+a59a3324
pkg:rpm/almalinux/nodejs?arch=aarch64&distro=almalinux-8.7	< 16.19.1-1.module_el8.7.0+3496+a59a3324
pkg:rpm/almalinux/nodejs-packaging?arch=noarch&distro=almalinux-8.5	< 25-1.module_el8.5.0+2605+45d748af
pkg:rpm/almalinux/nodejs-nodemon?arch=noarch&distro=almalinux-8.7	< 2.0.20-3.module_el8.7.0+3496+a59a3324
pkg:rpm/almalinux/nodejs-full-i18n?arch=x86_64&distro=almalinux-8.7	< 16.19.1-1.module_el8.7.0+3496+a59a3324
pkg:rpm/almalinux/nodejs-full-i18n?arch=aarch64&distro=almalinux-8.7	< 16.19.1-1.module_el8.7.0+3496+a59a3324
pkg:rpm/almalinux/nodejs-docs?arch=noarch&distro=almalinux-8.7	< 16.19.1-1.module_el8.7.0+3496+a59a3324
pkg:rpm/almalinux/nodejs-devel?arch=x86_64&distro=almalinux-8.7	< 16.19.1-1.module_el8.7.0+3496+a59a3324
pkg:rpm/almalinux/nodejs-devel?arch=aarch64&distro=almalinux-8.7	< 16.19.1-1.module_el8.7.0+3496+a59a3324

ID

ALSA-2023:1582

Severity

moderate

URL

https://errata.almalinux.org/ALSA-2023:1582.html

Published

2023-04-04T00:00:00
(17 months ago)

Modified

2023-04-20T12:04:52
(17 months ago)

Rights

Other Advisories

Source	# ID	URL
RHSA	RHSA-2023:1582	https://access.redhat.com/errata/RHSA-2023:1582
CVE	CVE-2021-35065	https://access.redhat.com/security/cve/CVE-2021-35065
CVE	CVE-2022-25881	https://access.redhat.com/security/cve/CVE-2022-25881
CVE	CVE-2022-4904	https://access.redhat.com/security/cve/CVE-2022-4904
CVE	CVE-2023-23918	https://access.redhat.com/security/cve/CVE-2023-23918
CVE	CVE-2023-23919	https://access.redhat.com/security/cve/CVE-2023-23919
CVE	CVE-2023-23920	https://access.redhat.com/security/cve/CVE-2023-23920
CVE	CVE-2023-23936	https://access.redhat.com/security/cve/CVE-2023-23936
CVE	CVE-2023-24807	https://access.redhat.com/security/cve/CVE-2023-24807
Bugzilla	2156324	https://bugzilla.redhat.com/2156324
Bugzilla	2165824	https://bugzilla.redhat.com/2165824
Bugzilla	2168631	https://bugzilla.redhat.com/2168631
Bugzilla	2171935	https://bugzilla.redhat.com/2171935
Bugzilla	2172170	https://bugzilla.redhat.com/2172170
Bugzilla	2172190	https://bugzilla.redhat.com/2172190
Bugzilla	2172204	https://bugzilla.redhat.com/2172204
Bugzilla	2172217	https://bugzilla.redhat.com/2172217
Self	ALSA-2023:1582	https://errata.almalinux.org/8/ALSA-2023-1582.html

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch
Affected	pkg:rpm/almalinux/npm?arch=x86_64&distro=almalinux-8.7	almalinux	npm	< 8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324	almalinux-8.7	x86_64
Affected	pkg:rpm/almalinux/npm?arch=aarch64&distro=almalinux-8.7	almalinux	npm	< 8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324	almalinux-8.7	aarch64
Affected	pkg:rpm/almalinux/nodejs?arch=x86_64&distro=almalinux-8.7	almalinux	nodejs	< 16.19.1-1.module_el8.7.0+3496+a59a3324	almalinux-8.7	x86_64
Affected	pkg:rpm/almalinux/nodejs?arch=aarch64&distro=almalinux-8.7	almalinux	nodejs	< 16.19.1-1.module_el8.7.0+3496+a59a3324	almalinux-8.7	aarch64
Affected	pkg:rpm/almalinux/nodejs-packaging?arch=noarch&distro=almalinux-8.5	almalinux	nodejs-packaging	< 25-1.module_el8.5.0+2605+45d748af	almalinux-8.5	noarch
Affected	pkg:rpm/almalinux/nodejs-nodemon?arch=noarch&distro=almalinux-8.7	almalinux	nodejs-nodemon	< 2.0.20-3.module_el8.7.0+3496+a59a3324	almalinux-8.7	noarch
Affected	pkg:rpm/almalinux/nodejs-full-i18n?arch=x86_64&distro=almalinux-8.7	almalinux	nodejs-full-i18n	< 16.19.1-1.module_el8.7.0+3496+a59a3324	almalinux-8.7	x86_64
Affected	pkg:rpm/almalinux/nodejs-full-i18n?arch=aarch64&distro=almalinux-8.7	almalinux	nodejs-full-i18n	< 16.19.1-1.module_el8.7.0+3496+a59a3324	almalinux-8.7	aarch64
Affected	pkg:rpm/almalinux/nodejs-docs?arch=noarch&distro=almalinux-8.7	almalinux	nodejs-docs	< 16.19.1-1.module_el8.7.0+3496+a59a3324	almalinux-8.7	noarch
Affected	pkg:rpm/almalinux/nodejs-devel?arch=x86_64&distro=almalinux-8.7	almalinux	nodejs-devel	< 16.19.1-1.module_el8.7.0+3496+a59a3324	almalinux-8.7	x86_64
Affected	pkg:rpm/almalinux/nodejs-devel?arch=aarch64&distro=almalinux-8.7	almalinux	nodejs-devel	< 16.19.1-1.module_el8.7.0+3496+a59a3324	almalinux-8.7	aarch64

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date