Important: nodejs:20 security update

2024-04-0800:00:00

errata.almalinux.org

node.js

security update

cve-2023-46809

cve-2024-22019

cve-2024-21892

cve-2024-21896

cve-2024-21891

cve-2024-21890

cve-2024-22017

unix

privilege escalation

buffer internals

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

8.2

Confidence

Low

EPSS

Percentile

16.3%

JSON

Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.

Security Fix(es):

nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809)
nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)
nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)
nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)
nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891)
nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)
nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

OSVersionArchitecturePackageVersionFilename
almalinux9noarchnodejs-docs< 20.11.1-1.module_el9.3.0+88+29afeaa2nodejs-docs-20.11.1-1.module_el9.3.0+88+29afeaa2.noarch.rpm
almalinux9noarchnodejs-packaging< 2021.06-4.module_el9.3.0+48+1cf146a1nodejs-packaging-2021.06-4.module_el9.3.0+48+1cf146a1.noarch.rpm
almalinux9noarchnodejs-nodemon< 3.0.1-1.module_el9.3.0+47+c33bc288nodejs-nodemon-3.0.1-1.module_el9.3.0+47+c33bc288.noarch.rpm
almalinux9noarchnodejs-packaging-bundler< 2021.06-4.module_el9.3.0+48+1cf146a1nodejs-packaging-bundler-2021.06-4.module_el9.3.0+48+1cf146a1.noarch.rpm
almalinux9ppc64lenodejs-full-i18n< 20.11.1-1.module_el9.3.0+88+29afeaa2nodejs-full-i18n-20.11.1-1.module_el9.3.0+88+29afeaa2.ppc64le.rpm
almalinux9ppc64lenodejs< 20.11.1-1.module_el9.3.0+88+29afeaa2nodejs-20.11.1-1.module_el9.3.0+88+29afeaa2.ppc64le.rpm
almalinux9ppc64lenpm< 10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2npm-10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2.ppc64le.rpm
almalinux9ppc64lenodejs-devel< 20.11.1-1.module_el9.3.0+88+29afeaa2nodejs-devel-20.11.1-1.module_el9.3.0+88+29afeaa2.ppc64le.rpm
almalinux9x86_64nodejs< 20.11.1-1.module_el9.3.0+88+29afeaa2nodejs-20.11.1-1.module_el9.3.0+88+29afeaa2.x86_64.rpm
almalinux9x86_64nodejs-devel< 20.11.1-1.module_el9.3.0+88+29afeaa2nodejs-devel-20.11.1-1.module_el9.3.0+88+29afeaa2.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	9	noarch	nodejs-docs	< 20.11.1-1.module_el9.3.0+88+29afeaa2	nodejs-docs-20.11.1-1.module_el9.3.0+88+29afeaa2.noarch.rpm
almalinux	9	noarch	nodejs-packaging	< 2021.06-4.module_el9.3.0+48+1cf146a1	nodejs-packaging-2021.06-4.module_el9.3.0+48+1cf146a1.noarch.rpm
almalinux	9	noarch	nodejs-nodemon	< 3.0.1-1.module_el9.3.0+47+c33bc288	nodejs-nodemon-3.0.1-1.module_el9.3.0+47+c33bc288.noarch.rpm
almalinux	9	noarch	nodejs-packaging-bundler	< 2021.06-4.module_el9.3.0+48+1cf146a1	nodejs-packaging-bundler-2021.06-4.module_el9.3.0+48+1cf146a1.noarch.rpm
almalinux	9	ppc64le	nodejs-full-i18n	< 20.11.1-1.module_el9.3.0+88+29afeaa2	nodejs-full-i18n-20.11.1-1.module_el9.3.0+88+29afeaa2.ppc64le.rpm
almalinux	9	ppc64le	nodejs	< 20.11.1-1.module_el9.3.0+88+29afeaa2	nodejs-20.11.1-1.module_el9.3.0+88+29afeaa2.ppc64le.rpm
almalinux	9	ppc64le	npm	< 10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2	npm-10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2.ppc64le.rpm
almalinux	9	ppc64le	nodejs-devel	< 20.11.1-1.module_el9.3.0+88+29afeaa2	nodejs-devel-20.11.1-1.module_el9.3.0+88+29afeaa2.ppc64le.rpm
almalinux	9	x86_64	nodejs	< 20.11.1-1.module_el9.3.0+88+29afeaa2	nodejs-20.11.1-1.module_el9.3.0+88+29afeaa2.x86_64.rpm
almalinux	9	x86_64	nodejs-devel	< 20.11.1-1.module_el9.3.0+88+29afeaa2	nodejs-devel-20.11.1-1.module_el9.3.0+88+29afeaa2.x86_64.rpm