[RHSA-2021:3666] nodejs:14 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)
nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)
c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)
nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)
nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)
nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)
nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)
nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)
- ID
- RHSA-2021:3666
- Severity
- important
- URL
- https://access.redhat.com/errata/RHSA-2021:3666
- Published
-
2021-09-27T00:00:00
(3 years ago) - Modified
-
2021-09-27T00:00:00
(3 years ago) - Rights
- Copyright 2021 Red Hat, Inc.
- Other Advisories
-
- ALAS-2021-1545
- ALAS2-2024-2399
- ALPINE:CVE-2021-22930
- ALPINE:CVE-2021-22931
- ALPINE:CVE-2021-22939
- ALPINE:CVE-2021-3672
- ALSA-2021:3623
- ALSA-2021:3666
- ALSA-2022:2043
- ASA-202108-1
- ASA-202108-13
- DSA-4954-1
- ELSA-2021-3623
- ELSA-2021-3666
- ELSA-2022-2043
- FEDORA-2021-001ec24fc5
- FEDORA-2021-0a60cbb948
- FEDORA-2021-52c89b44a9
- FEDORA-2021-a48cf28c13
- FEDORA-2021-c83b66abdb
- FREEBSD:43E9FFD4-D6E0-11ED-956F-7054D21A9E2A
- FREEBSD:7062BCE0-1B17-11EC-9D9D-0022489AD614
- FREEBSD:B092BD4F-1B16-11EC-9D9D-0022489AD614
- FREEBSD:C9387E4D-2F5F-11EC-8BE6-D4C9EF517024
- FREEBSD:F53DAB71-1B15-11EC-9D9D-0022489AD614
- GLSA-202401-02
- GLSA-202405-29
- MS:CVE-2021-22930
- MS:CVE-2021-3672
- NPM:GHSA-3JFQ-G458-7QM9
- NPM:GHSA-HJ48-42VR-X3V9
- NPM:GHSA-R628-MHMH-QJHW
- openSUSE-SU-2021:1168-1
- openSUSE-SU-2021:1214-1
- openSUSE-SU-2021:1239-1
- openSUSE-SU-2021:1313-1
- openSUSE-SU-2021:1343-1
- openSUSE-SU-2021:2760-1
- openSUSE-SU-2021:2875-1
- openSUSE-SU-2021:2953-1
- openSUSE-SU-2021:3211-1
- openSUSE-SU-2021:3294-1
- openSUSE-SU-2022:0657-1
- openSUSE-SU-2022:0704-1
- openSUSE-SU-2022:0715-1
- RHSA-2021:3623
- RHSA-2022:2043
- RLSA-2021:3623
- RLSA-2021:3666
- RLSA-2022:2043
- SUSE-SU-2021:2690-1
- SUSE-SU-2021:2760-1
- SUSE-SU-2021:2790-1
- SUSE-SU-2021:2823-1
- SUSE-SU-2021:2824-1
- SUSE-SU-2021:2875-1
- SUSE-SU-2021:2953-1
- SUSE-SU-2021:3184-1
- SUSE-SU-2021:3211-1
- SUSE-SU-2021:3294-1
- SUSE-SU-2022:0531-1
- SUSE-SU-2022:0563-1
- SUSE-SU-2022:0569-1
- SUSE-SU-2022:0570-1
- SUSE-SU-2022:0657-1
- SUSE-SU-2022:0704-1
- SUSE-SU-2022:0715-1
- SUSE-SU-2022:1717-1
- SUSE-SU-2022:2855-1
- USN-5034-1
- USN-5034-2
- USN-5283-1
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/redhat/npm?arch=x86_64&distro=redhat-8.4 | redhat | npm | < 6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | x86_64 | |
Affected | pkg:rpm/redhat/npm?arch=s390x&distro=redhat-8.4 | redhat | npm | < 6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | s390x | |
Affected | pkg:rpm/redhat/npm?arch=ppc64le&distro=redhat-8.4 | redhat | npm | < 6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | ppc64le | |
Affected | pkg:rpm/redhat/npm?arch=aarch64&distro=redhat-8.4 | redhat | npm | < 6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | aarch64 | |
Affected | pkg:rpm/redhat/nodejs?arch=x86_64&distro=redhat-8.4 | redhat | nodejs | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | x86_64 | |
Affected | pkg:rpm/redhat/nodejs?arch=s390x&distro=redhat-8.4 | redhat | nodejs | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | s390x | |
Affected | pkg:rpm/redhat/nodejs?arch=ppc64le&distro=redhat-8.4 | redhat | nodejs | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | ppc64le | |
Affected | pkg:rpm/redhat/nodejs?arch=aarch64&distro=redhat-8.4 | redhat | nodejs | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | aarch64 | |
Affected | pkg:rpm/redhat/nodejs-packaging?distro=redhat-8.3 | redhat | nodejs-packaging | < 23-3.module+el8.3.0+6519+9f98ed83 | redhat-8.3 | ||
Affected | pkg:rpm/redhat/nodejs-nodemon?distro=redhat-8.3 | redhat | nodejs-nodemon | < 2.0.3-1.module+el8.3.0+6519+9f98ed83 | redhat-8.3 | ||
Affected | pkg:rpm/redhat/nodejs-full-i18n?arch=x86_64&distro=redhat-8.4 | redhat | nodejs-full-i18n | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | x86_64 | |
Affected | pkg:rpm/redhat/nodejs-full-i18n?arch=s390x&distro=redhat-8.4 | redhat | nodejs-full-i18n | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | s390x | |
Affected | pkg:rpm/redhat/nodejs-full-i18n?arch=ppc64le&distro=redhat-8.4 | redhat | nodejs-full-i18n | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | ppc64le | |
Affected | pkg:rpm/redhat/nodejs-full-i18n?arch=aarch64&distro=redhat-8.4 | redhat | nodejs-full-i18n | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | aarch64 | |
Affected | pkg:rpm/redhat/nodejs-docs?distro=redhat-8.4 | redhat | nodejs-docs | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | ||
Affected | pkg:rpm/redhat/nodejs-devel?arch=x86_64&distro=redhat-8.4 | redhat | nodejs-devel | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | x86_64 | |
Affected | pkg:rpm/redhat/nodejs-devel?arch=s390x&distro=redhat-8.4 | redhat | nodejs-devel | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | s390x | |
Affected | pkg:rpm/redhat/nodejs-devel?arch=ppc64le&distro=redhat-8.4 | redhat | nodejs-devel | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | ppc64le | |
Affected | pkg:rpm/redhat/nodejs-devel?arch=aarch64&distro=redhat-8.4 | redhat | nodejs-devel | < 14.17.5-1.module+el8.4.0+12247+e2879e58 | redhat-8.4 | aarch64 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |