1. Home
  2. Security Advisories
  3. Fedora
  4. FEDORA-2022-de515f765f

[FEDORA-2022-de515f765f] Fedora 35: nodejs

Severity Critical
Affected Packages 1
CVEs 5
Info Packages References Vulnerabilities

November 2022 Security Updates
https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/ ----
September Security Updates for
Node.js ---- Update to Node.js 16.17.0
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V16.md#16.17.0
---- Fix dependency typo ---- Update to 16.15.0 ---- Update to Node.js
16.14.1 Note that we will be skipping 16.14.2 since the only changes were in
the bundled copy of OpenSSL, which we do not use. The relevant security patches
are handled in Fedora's openssl package.

Package Affected Version
pkg:rpm/fedora/nodejs?distro=fedora-35 < 16.18.1.1.fc35
ID
FEDORA-2022-de515f765f
Severity
critical
Severity from
CVE-2022-35255
URL
https://bodhi.fedoraproject.org/updates/FEDORA-2022-de515f765f
Published
2022-11-29T00:57:02
(21 months ago)
Modified
2022-11-29T00:57:02
(21 months ago)
Rights
Copyright 2022 Red Hat, Inc.
Other Advisories
Source # ID Name URL
Bugzilla 2105422 Bug #2105422 - CVE-2022-32212 nodejs: DNS rebinding in --inspect via invalid IP addresses https://bugzilla.redhat.com/show_bug.cgi?id=2105422
Bugzilla 2105426 Bug #2105426 - CVE-2022-32215 nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding https://bugzilla.redhat.com/show_bug.cgi?id=2105426
Bugzilla 2130518 Bug #2130518 - CVE-2022-35256 nodejs: HTTP Request Smuggling due to incorrect parsing of header fields https://bugzilla.redhat.com/show_bug.cgi?id=2130518
Bugzilla 2105430 Bug #2105430 - CVE-2022-32213 nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding https://bugzilla.redhat.com/show_bug.cgi?id=2105430
Bugzilla 2130517 Bug #2130517 - CVE-2022-35255 nodejs: weak randomness in WebCrypto keygen https://bugzilla.redhat.com/show_bug.cgi?id=2130517
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/fedora/nodejs?distro=fedora-35 fedora nodejs < 16.18.1.1.fc35 fedora-35
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date