[RHSA-2023:4331] nodejs security, bug fix, and enhancement update

Severity Moderate

Affected Packages 18

CVEs 4

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (16.20.1). (BZ#2223334, BZ#2223336, BZ#2223338, BZ#2223340, BZ#2223342, BZ#2223344)

Security Fix(es):

nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package	Affected Version
pkg:rpm/redhat/npm?arch=x86_64&distro=redhat-9.2	< 8.19.4-1.16.20.1.1.el9_2
pkg:rpm/redhat/npm?arch=s390x&distro=redhat-9.2	< 8.19.4-1.16.20.1.1.el9_2
pkg:rpm/redhat/npm?arch=ppc64le&distro=redhat-9.2	< 8.19.4-1.16.20.1.1.el9_2
pkg:rpm/redhat/npm?arch=aarch64&distro=redhat-9.2	< 8.19.4-1.16.20.1.1.el9_2
pkg:rpm/redhat/nodejs?arch=x86_64&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs?arch=s390x&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs?arch=ppc64le&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs?arch=aarch64&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs-libs?arch=x86_64&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs-libs?arch=s390x&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs-libs?arch=ppc64le&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs-libs?arch=i686&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs-libs?arch=aarch64&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs-full-i18n?arch=x86_64&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs-full-i18n?arch=s390x&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs-full-i18n?arch=ppc64le&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs-full-i18n?arch=aarch64&distro=redhat-9.2	< 16.20.1-1.el9_2
pkg:rpm/redhat/nodejs-docs?distro=redhat-9.2	< 16.20.1-1.el9_2

ID

RHSA-2023:4331

Severity

moderate

URL

https://access.redhat.com/errata/RHSA-2023:4331

Published

2023-07-31T00:00:00
(13 months ago)

Modified

2023-07-31T00:00:00
(13 months ago)

Rights

Other Advisories

Source	# ID	URL
Bugzilla	2219824	https://bugzilla.redhat.com/2219824
Bugzilla	2219838	https://bugzilla.redhat.com/2219838
Bugzilla	2219841	https://bugzilla.redhat.com/2219841
Bugzilla	2219842	https://bugzilla.redhat.com/2219842
RHSA	RHSA-2023:4331	https://access.redhat.com/errata/RHSA-2023:4331
CVE	CVE-2023-30581	https://access.redhat.com/security/cve/CVE-2023-30581
CVE	CVE-2023-30588	https://access.redhat.com/security/cve/CVE-2023-30588
CVE	CVE-2023-30589	https://access.redhat.com/security/cve/CVE-2023-30589
CVE	CVE-2023-30590	https://access.redhat.com/security/cve/CVE-2023-30590

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch
Affected	pkg:rpm/redhat/npm?arch=x86_64&distro=redhat-9.2	redhat	npm	< 8.19.4-1.16.20.1.1.el9_2	redhat-9.2	x86_64
Affected	pkg:rpm/redhat/npm?arch=s390x&distro=redhat-9.2	redhat	npm	< 8.19.4-1.16.20.1.1.el9_2	redhat-9.2	s390x
Affected	pkg:rpm/redhat/npm?arch=ppc64le&distro=redhat-9.2	redhat	npm	< 8.19.4-1.16.20.1.1.el9_2	redhat-9.2	ppc64le
Affected	pkg:rpm/redhat/npm?arch=aarch64&distro=redhat-9.2	redhat	npm	< 8.19.4-1.16.20.1.1.el9_2	redhat-9.2	aarch64
Affected	pkg:rpm/redhat/nodejs?arch=x86_64&distro=redhat-9.2	redhat	nodejs	< 16.20.1-1.el9_2	redhat-9.2	x86_64
Affected	pkg:rpm/redhat/nodejs?arch=s390x&distro=redhat-9.2	redhat	nodejs	< 16.20.1-1.el9_2	redhat-9.2	s390x
Affected	pkg:rpm/redhat/nodejs?arch=ppc64le&distro=redhat-9.2	redhat	nodejs	< 16.20.1-1.el9_2	redhat-9.2	ppc64le
Affected	pkg:rpm/redhat/nodejs?arch=aarch64&distro=redhat-9.2	redhat	nodejs	< 16.20.1-1.el9_2	redhat-9.2	aarch64
Affected	pkg:rpm/redhat/nodejs-libs?arch=x86_64&distro=redhat-9.2	redhat	nodejs-libs	< 16.20.1-1.el9_2	redhat-9.2	x86_64
Affected	pkg:rpm/redhat/nodejs-libs?arch=s390x&distro=redhat-9.2	redhat	nodejs-libs	< 16.20.1-1.el9_2	redhat-9.2	s390x
Affected	pkg:rpm/redhat/nodejs-libs?arch=ppc64le&distro=redhat-9.2	redhat	nodejs-libs	< 16.20.1-1.el9_2	redhat-9.2	ppc64le
Affected	pkg:rpm/redhat/nodejs-libs?arch=i686&distro=redhat-9.2	redhat	nodejs-libs	< 16.20.1-1.el9_2	redhat-9.2	i686
Affected	pkg:rpm/redhat/nodejs-libs?arch=aarch64&distro=redhat-9.2	redhat	nodejs-libs	< 16.20.1-1.el9_2	redhat-9.2	aarch64
Affected	pkg:rpm/redhat/nodejs-full-i18n?arch=x86_64&distro=redhat-9.2	redhat	nodejs-full-i18n	< 16.20.1-1.el9_2	redhat-9.2	x86_64
Affected	pkg:rpm/redhat/nodejs-full-i18n?arch=s390x&distro=redhat-9.2	redhat	nodejs-full-i18n	< 16.20.1-1.el9_2	redhat-9.2	s390x
Affected	pkg:rpm/redhat/nodejs-full-i18n?arch=ppc64le&distro=redhat-9.2	redhat	nodejs-full-i18n	< 16.20.1-1.el9_2	redhat-9.2	ppc64le
Affected	pkg:rpm/redhat/nodejs-full-i18n?arch=aarch64&distro=redhat-9.2	redhat	nodejs-full-i18n	< 16.20.1-1.el9_2	redhat-9.2	aarch64
Affected	pkg:rpm/redhat/nodejs-docs?distro=redhat-9.2	redhat	nodejs-docs	< 16.20.1-1.el9_2	redhat-9.2

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date