[ALSA-2023:1583] nodejs:18 security, bug fix, and enhancement update

Severity Moderate

Affected Packages 12

CVEs 6

nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package	Affected Version
pkg:rpm/almalinux/npm?arch=x86_64&distro=almalinux-8.7	< 9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7
pkg:rpm/almalinux/npm?arch=aarch64&distro=almalinux-8.7	< 9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7
pkg:rpm/almalinux/nodejs?arch=x86_64&distro=almalinux-8.7	< 18.14.2-2.module_el8.7.0+3497+c65299e7
pkg:rpm/almalinux/nodejs?arch=aarch64&distro=almalinux-8.7	< 18.14.2-2.module_el8.7.0+3497+c65299e7
pkg:rpm/almalinux/nodejs-packaging?arch=noarch&distro=almalinux-8.7	< 2021.06-4.module_el8.7.0+3343+ea2b7901
pkg:rpm/almalinux/nodejs-packaging-bundler?arch=noarch&distro=almalinux-8.7	< 2021.06-4.module_el8.7.0+3343+ea2b7901
pkg:rpm/almalinux/nodejs-nodemon?arch=noarch&distro=almalinux-8.7	< 2.0.20-2.module_el8.7.0+3497+c65299e7
pkg:rpm/almalinux/nodejs-full-i18n?arch=x86_64&distro=almalinux-8.7	< 18.14.2-2.module_el8.7.0+3497+c65299e7
pkg:rpm/almalinux/nodejs-full-i18n?arch=aarch64&distro=almalinux-8.7	< 18.14.2-2.module_el8.7.0+3497+c65299e7
pkg:rpm/almalinux/nodejs-docs?arch=noarch&distro=almalinux-8.7	< 18.14.2-2.module_el8.7.0+3497+c65299e7
pkg:rpm/almalinux/nodejs-devel?arch=x86_64&distro=almalinux-8.7	< 18.14.2-2.module_el8.7.0+3497+c65299e7
pkg:rpm/almalinux/nodejs-devel?arch=aarch64&distro=almalinux-8.7	< 18.14.2-2.module_el8.7.0+3497+c65299e7

ID

ALSA-2023:1583

Severity

moderate

URL

https://errata.almalinux.org/ALSA-2023:1583.html

Published

2023-04-04T00:00:00
(17 months ago)

Modified

2023-04-20T12:25:58
(17 months ago)

Rights

Other Advisories

Source	# ID	URL
RHSA	RHSA-2023:1583	https://access.redhat.com/errata/RHSA-2023:1583
CVE	CVE-2021-35065	https://access.redhat.com/security/cve/CVE-2021-35065
CVE	CVE-2022-25881	https://access.redhat.com/security/cve/CVE-2022-25881
CVE	CVE-2023-23918	https://access.redhat.com/security/cve/CVE-2023-23918
CVE	CVE-2023-23920	https://access.redhat.com/security/cve/CVE-2023-23920
CVE	CVE-2023-23936	https://access.redhat.com/security/cve/CVE-2023-23936
CVE	CVE-2023-24807	https://access.redhat.com/security/cve/CVE-2023-24807
Bugzilla	2156324	https://bugzilla.redhat.com/2156324
Bugzilla	2165824	https://bugzilla.redhat.com/2165824
Bugzilla	2171935	https://bugzilla.redhat.com/2171935
Bugzilla	2172190	https://bugzilla.redhat.com/2172190
Bugzilla	2172204	https://bugzilla.redhat.com/2172204
Bugzilla	2172217	https://bugzilla.redhat.com/2172217
Self	ALSA-2023:1583	https://errata.almalinux.org/8/ALSA-2023-1583.html

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch
Affected	pkg:rpm/almalinux/npm?arch=x86_64&distro=almalinux-8.7	almalinux	npm	< 9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7	almalinux-8.7	x86_64
Affected	pkg:rpm/almalinux/npm?arch=aarch64&distro=almalinux-8.7	almalinux	npm	< 9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7	almalinux-8.7	aarch64
Affected	pkg:rpm/almalinux/nodejs?arch=x86_64&distro=almalinux-8.7	almalinux	nodejs	< 18.14.2-2.module_el8.7.0+3497+c65299e7	almalinux-8.7	x86_64
Affected	pkg:rpm/almalinux/nodejs?arch=aarch64&distro=almalinux-8.7	almalinux	nodejs	< 18.14.2-2.module_el8.7.0+3497+c65299e7	almalinux-8.7	aarch64
Affected	pkg:rpm/almalinux/nodejs-packaging?arch=noarch&distro=almalinux-8.7	almalinux	nodejs-packaging	< 2021.06-4.module_el8.7.0+3343+ea2b7901	almalinux-8.7	noarch
Affected	pkg:rpm/almalinux/nodejs-packaging-bundler?arch=noarch&distro=almalinux-8.7	almalinux	nodejs-packaging-bundler	< 2021.06-4.module_el8.7.0+3343+ea2b7901	almalinux-8.7	noarch
Affected	pkg:rpm/almalinux/nodejs-nodemon?arch=noarch&distro=almalinux-8.7	almalinux	nodejs-nodemon	< 2.0.20-2.module_el8.7.0+3497+c65299e7	almalinux-8.7	noarch
Affected	pkg:rpm/almalinux/nodejs-full-i18n?arch=x86_64&distro=almalinux-8.7	almalinux	nodejs-full-i18n	< 18.14.2-2.module_el8.7.0+3497+c65299e7	almalinux-8.7	x86_64
Affected	pkg:rpm/almalinux/nodejs-full-i18n?arch=aarch64&distro=almalinux-8.7	almalinux	nodejs-full-i18n	< 18.14.2-2.module_el8.7.0+3497+c65299e7	almalinux-8.7	aarch64
Affected	pkg:rpm/almalinux/nodejs-docs?arch=noarch&distro=almalinux-8.7	almalinux	nodejs-docs	< 18.14.2-2.module_el8.7.0+3497+c65299e7	almalinux-8.7	noarch
Affected	pkg:rpm/almalinux/nodejs-devel?arch=x86_64&distro=almalinux-8.7	almalinux	nodejs-devel	< 18.14.2-2.module_el8.7.0+3497+c65299e7	almalinux-8.7	x86_64
Affected	pkg:rpm/almalinux/nodejs-devel?arch=aarch64&distro=almalinux-8.7	almalinux	nodejs-devel	< 18.14.2-2.module_el8.7.0+3497+c65299e7	almalinux-8.7	aarch64

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date