[ALSA-2024:5814] nodejs:20 security update

Severity Moderate

Affected Packages 12

CVEs 4

nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)
nodejs: Bypass network import restriction via data URL (CVE-2024-22020)
nodejs: fs.lstat bypasses permission model (CVE-2024-22018)
nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package	Affected Version
pkg:rpm/almalinux/npm?arch=x86_64&distro=almalinux-8.1	< 10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db
pkg:rpm/almalinux/npm?arch=aarch64&distro=almalinux-8.1	< 10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db
pkg:rpm/almalinux/nodejs?arch=x86_64&distro=almalinux-8.1	< 20.16.0-1.module_el8.10.0+3882+e12e42db
pkg:rpm/almalinux/nodejs?arch=aarch64&distro=almalinux-8.1	< 20.16.0-1.module_el8.10.0+3882+e12e42db
pkg:rpm/almalinux/nodejs-packaging?arch=noarch&distro=almalinux-8.9	< 2021.06-4.module_el8.9.0+3775+d8460d35
pkg:rpm/almalinux/nodejs-packaging-bundler?arch=noarch&distro=almalinux-8.9	< 2021.06-4.module_el8.9.0+3775+d8460d35
pkg:rpm/almalinux/nodejs-nodemon?arch=noarch&distro=almalinux-8.9	< 3.0.1-1.module_el8.9.0+3731+490e3ce5
pkg:rpm/almalinux/nodejs-full-i18n?arch=x86_64&distro=almalinux-8.1	< 20.16.0-1.module_el8.10.0+3882+e12e42db
pkg:rpm/almalinux/nodejs-full-i18n?arch=aarch64&distro=almalinux-8.1	< 20.16.0-1.module_el8.10.0+3882+e12e42db
pkg:rpm/almalinux/nodejs-docs?arch=noarch&distro=almalinux-8.1	< 20.16.0-1.module_el8.10.0+3882+e12e42db
pkg:rpm/almalinux/nodejs-devel?arch=x86_64&distro=almalinux-8.1	< 20.16.0-1.module_el8.10.0+3882+e12e42db
pkg:rpm/almalinux/nodejs-devel?arch=aarch64&distro=almalinux-8.1	< 20.16.0-1.module_el8.10.0+3882+e12e42db

ID

ALSA-2024:5814

Severity

moderate

URL

https://errata.almalinux.org/ALSA-2024:5814.html

Published

2024-08-26T00:00:00
(3 weeks ago)

Modified

2024-08-26T18:53:15
(3 weeks ago)

Rights

Other Advisories

Source	# ID	URL
RHSA	RHSA-2024:5814	https://access.redhat.com/errata/RHSA-2024:5814
CVE	CVE-2024-22018	https://access.redhat.com/security/cve/CVE-2024-22018
CVE	CVE-2024-22020	https://access.redhat.com/security/cve/CVE-2024-22020
CVE	CVE-2024-28863	https://access.redhat.com/security/cve/CVE-2024-28863
CVE	CVE-2024-36137	https://access.redhat.com/security/cve/CVE-2024-36137
Bugzilla	2293200	https://bugzilla.redhat.com/2293200
Bugzilla	2296417	https://bugzilla.redhat.com/2296417
Bugzilla	2296990	https://bugzilla.redhat.com/2296990
Bugzilla	2299281	https://bugzilla.redhat.com/2299281
Self	ALSA-2024:5814	https://errata.almalinux.org/8/ALSA-2024-5814.html

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch
Affected	pkg:rpm/almalinux/npm?arch=x86_64&distro=almalinux-8.1	almalinux	npm	< 10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db	almalinux-8.1	x86_64
Affected	pkg:rpm/almalinux/npm?arch=aarch64&distro=almalinux-8.1	almalinux	npm	< 10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db	almalinux-8.1	aarch64
Affected	pkg:rpm/almalinux/nodejs?arch=x86_64&distro=almalinux-8.1	almalinux	nodejs	< 20.16.0-1.module_el8.10.0+3882+e12e42db	almalinux-8.1	x86_64
Affected	pkg:rpm/almalinux/nodejs?arch=aarch64&distro=almalinux-8.1	almalinux	nodejs	< 20.16.0-1.module_el8.10.0+3882+e12e42db	almalinux-8.1	aarch64
Affected	pkg:rpm/almalinux/nodejs-packaging?arch=noarch&distro=almalinux-8.9	almalinux	nodejs-packaging	< 2021.06-4.module_el8.9.0+3775+d8460d35	almalinux-8.9	noarch
Affected	pkg:rpm/almalinux/nodejs-packaging-bundler?arch=noarch&distro=almalinux-8.9	almalinux	nodejs-packaging-bundler	< 2021.06-4.module_el8.9.0+3775+d8460d35	almalinux-8.9	noarch
Affected	pkg:rpm/almalinux/nodejs-nodemon?arch=noarch&distro=almalinux-8.9	almalinux	nodejs-nodemon	< 3.0.1-1.module_el8.9.0+3731+490e3ce5	almalinux-8.9	noarch
Affected	pkg:rpm/almalinux/nodejs-full-i18n?arch=x86_64&distro=almalinux-8.1	almalinux	nodejs-full-i18n	< 20.16.0-1.module_el8.10.0+3882+e12e42db	almalinux-8.1	x86_64
Affected	pkg:rpm/almalinux/nodejs-full-i18n?arch=aarch64&distro=almalinux-8.1	almalinux	nodejs-full-i18n	< 20.16.0-1.module_el8.10.0+3882+e12e42db	almalinux-8.1	aarch64
Affected	pkg:rpm/almalinux/nodejs-docs?arch=noarch&distro=almalinux-8.1	almalinux	nodejs-docs	< 20.16.0-1.module_el8.10.0+3882+e12e42db	almalinux-8.1	noarch
Affected	pkg:rpm/almalinux/nodejs-devel?arch=x86_64&distro=almalinux-8.1	almalinux	nodejs-devel	< 20.16.0-1.module_el8.10.0+3882+e12e42db	almalinux-8.1	x86_64
Affected	pkg:rpm/almalinux/nodejs-devel?arch=aarch64&distro=almalinux-8.1	almalinux	nodejs-devel	< 20.16.0-1.module_el8.10.0+3882+e12e42db	almalinux-8.1	aarch64

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date