Moderate: nodejs:18 security, bug fix, and enhancement update

2023-07-3100:00:00

errata.almalinux.org

node.js

security fix

bug fix

enhancement update

cve-2023-30581

cve-2023-30588

cve-2023-30589

cve-2023-30590

bz#2223314

bz#2223316

bz#2223318

bz#2223319

bz#2223320

bz#2223354

x509 certificates

http request smuggling

diffiehellman

cvss score

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

40.3%

JSON

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (18). (BZ#2223314, BZ#2223316, BZ#2223318, BZ#2223319, BZ#2223320, BZ#2223354)

Security Fix(es):

nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux9noarchnodejs-packaging< 2021.06-4.module_el9.1.0+13+d9a595eanodejs-packaging-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux9noarchnodejs-docs< 18.16.1-1.module_el9.2.0+31+cbae0c8enodejs-docs-18.16.1-1.module_el9.2.0+31+cbae0c8e.noarch.rpm
almalinux9noarchnodejs-packaging-bundler< 2021.06-4.module_el9.1.0+13+d9a595eanodejs-packaging-bundler-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux9noarchnodejs-nodemon< 2.0.20-2.module_el9.2.0+29+de583a0bnodejs-nodemon-2.0.20-2.module_el9.2.0+29+de583a0b.noarch.rpm
almalinux9ppc64lenodejs-devel< 18.16.1-1.module_el9.2.0+31+cbae0c8enodejs-devel-18.16.1-1.module_el9.2.0+31+cbae0c8e.ppc64le.rpm
almalinux9ppc64lenodejs< 18.16.1-1.module_el9.2.0+31+cbae0c8enodejs-18.16.1-1.module_el9.2.0+31+cbae0c8e.ppc64le.rpm
almalinux9ppc64lenpm< 9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8enpm-9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e.ppc64le.rpm
almalinux9ppc64lenodejs-full-i18n< 18.16.1-1.module_el9.2.0+31+cbae0c8enodejs-full-i18n-18.16.1-1.module_el9.2.0+31+cbae0c8e.ppc64le.rpm
almalinux9x86_64npm< 9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8enpm-9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e.x86_64.rpm
almalinux9x86_64nodejs-full-i18n< 18.16.1-1.module_el9.2.0+31+cbae0c8enodejs-full-i18n-18.16.1-1.module_el9.2.0+31+cbae0c8e.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	9	noarch	nodejs-packaging	< 2021.06-4.module_el9.1.0+13+d9a595ea	nodejs-packaging-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux	9	noarch	nodejs-docs	< 18.16.1-1.module_el9.2.0+31+cbae0c8e	nodejs-docs-18.16.1-1.module_el9.2.0+31+cbae0c8e.noarch.rpm
almalinux	9	noarch	nodejs-packaging-bundler	< 2021.06-4.module_el9.1.0+13+d9a595ea	nodejs-packaging-bundler-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux	9	noarch	nodejs-nodemon	< 2.0.20-2.module_el9.2.0+29+de583a0b	nodejs-nodemon-2.0.20-2.module_el9.2.0+29+de583a0b.noarch.rpm
almalinux	9	ppc64le	nodejs-devel	< 18.16.1-1.module_el9.2.0+31+cbae0c8e	nodejs-devel-18.16.1-1.module_el9.2.0+31+cbae0c8e.ppc64le.rpm
almalinux	9	ppc64le	nodejs	< 18.16.1-1.module_el9.2.0+31+cbae0c8e	nodejs-18.16.1-1.module_el9.2.0+31+cbae0c8e.ppc64le.rpm
almalinux	9	ppc64le	npm	< 9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e	npm-9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e.ppc64le.rpm
almalinux	9	ppc64le	nodejs-full-i18n	< 18.16.1-1.module_el9.2.0+31+cbae0c8e	nodejs-full-i18n-18.16.1-1.module_el9.2.0+31+cbae0c8e.ppc64le.rpm
almalinux	9	x86_64	npm	< 9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e	npm-9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e.x86_64.rpm
almalinux	9	x86_64	nodejs-full-i18n	< 18.16.1-1.module_el9.2.0+31+cbae0c8e	nodejs-full-i18n-18.16.1-1.module_el9.2.0+31+cbae0c8e.x86_64.rpm