[RLSA-2021:3666] nodejs:14 security and bug fix update
An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)
nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)
c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)
nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)
nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)
nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)
nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)
nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)
Package | Affected Version |
---|---|
pkg:rpm/rockylinux/nodejs-packaging?arch=noarch&distro=rockylinux-8.7 | < 23-3.module+el8.7.0+1071+4bdda2a8 |
pkg:rpm/rockylinux/nodejs-nodemon?arch=noarch&distro=rockylinux-8.6 | < 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
- ID
- RLSA-2021:3666
- Severity
- important
- URL
- https://errata.rockylinux.org/RLSA-2021:3666
- Published
-
2021-09-27T06:47:35
(3 years ago) - Modified
-
2023-02-02T13:27:12
(19 months ago) - Rights
- Copyright 2024 Rocky Enterprise Software Foundation
- Other Advisories
-
- ALAS-2021-1545
- ALAS2-2024-2399
- ALPINE:CVE-2021-22930
- ALPINE:CVE-2021-22931
- ALPINE:CVE-2021-22939
- ALPINE:CVE-2021-3672
- ALSA-2021:3623
- ALSA-2021:3666
- ALSA-2022:2043
- ASA-202108-1
- ASA-202108-13
- DSA-4954-1
- ELSA-2021-3623
- ELSA-2021-3666
- ELSA-2022-2043
- FEDORA-2021-001ec24fc5
- FEDORA-2021-0a60cbb948
- FEDORA-2021-52c89b44a9
- FEDORA-2021-a48cf28c13
- FEDORA-2021-c83b66abdb
- FREEBSD:43E9FFD4-D6E0-11ED-956F-7054D21A9E2A
- FREEBSD:7062BCE0-1B17-11EC-9D9D-0022489AD614
- FREEBSD:B092BD4F-1B16-11EC-9D9D-0022489AD614
- FREEBSD:C9387E4D-2F5F-11EC-8BE6-D4C9EF517024
- FREEBSD:F53DAB71-1B15-11EC-9D9D-0022489AD614
- GLSA-202401-02
- GLSA-202405-29
- MS:CVE-2021-22930
- MS:CVE-2021-3672
- NPM:GHSA-3JFQ-G458-7QM9
- NPM:GHSA-HJ48-42VR-X3V9
- NPM:GHSA-R628-MHMH-QJHW
- openSUSE-SU-2021:1168-1
- openSUSE-SU-2021:1214-1
- openSUSE-SU-2021:1239-1
- openSUSE-SU-2021:1313-1
- openSUSE-SU-2021:1343-1
- openSUSE-SU-2021:2760-1
- openSUSE-SU-2021:2875-1
- openSUSE-SU-2021:2953-1
- openSUSE-SU-2021:3211-1
- openSUSE-SU-2021:3294-1
- openSUSE-SU-2022:0657-1
- openSUSE-SU-2022:0704-1
- openSUSE-SU-2022:0715-1
- RHSA-2021:3623
- RHSA-2021:3666
- RHSA-2022:2043
- RLSA-2021:3623
- RLSA-2022:2043
- SUSE-SU-2021:2690-1
- SUSE-SU-2021:2760-1
- SUSE-SU-2021:2790-1
- SUSE-SU-2021:2823-1
- SUSE-SU-2021:2824-1
- SUSE-SU-2021:2875-1
- SUSE-SU-2021:2953-1
- SUSE-SU-2021:3184-1
- SUSE-SU-2021:3211-1
- SUSE-SU-2021:3294-1
- SUSE-SU-2022:0531-1
- SUSE-SU-2022:0563-1
- SUSE-SU-2022:0569-1
- SUSE-SU-2022:0570-1
- SUSE-SU-2022:0657-1
- SUSE-SU-2022:0704-1
- SUSE-SU-2022:0715-1
- SUSE-SU-2022:1717-1
- SUSE-SU-2022:2855-1
- USN-5034-1
- USN-5034-2
- USN-5283-1
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/rockylinux/nodejs-packaging?arch=noarch&distro=rockylinux-8.7 | rockylinux | nodejs-packaging | < 23-3.module+el8.7.0+1071+4bdda2a8 | rockylinux-8.7 | noarch | |
Affected | pkg:rpm/rockylinux/nodejs-nodemon?arch=noarch&distro=rockylinux-8.6 | rockylinux | nodejs-nodemon | < 2.0.3-1.module+el8.6.0+982+9fdca2d4 | rockylinux-8.6 | noarch |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |