Moderate: nodejs:18 security update

2024-09-0300:00:00

errata.almalinux.org

node.js platform

security update

denial of service

network import

cve-2024-28863

cve-2024-22020

cvss score

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.7

Confidence

High

JSON

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)
nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux9noarchnodejs-nodemon< 3.0.1-1.module_el9.2.0+36+853e48f5nodejs-nodemon-3.0.1-1.module_el9.2.0+36+853e48f5.noarch.rpm
almalinux9noarchnodejs-packaging< 2021.06-4.module_el9.1.0+13+d9a595eanodejs-packaging-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux9noarchnodejs-packaging-bundler< 2021.06-4.module_el9.1.0+13+d9a595eanodejs-packaging-bundler-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux9noarchnodejs-docs< 18.20.4-1.module_el9.4.0+112+bb28ff81nodejs-docs-18.20.4-1.module_el9.4.0+112+bb28ff81.noarch.rpm
almalinux9aarch64nodejs< 18.20.4-1.module_el9.4.0+112+bb28ff81nodejs-18.20.4-1.module_el9.4.0+112+bb28ff81.aarch64.rpm
almalinux9aarch64npm< 10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81npm-10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81.aarch64.rpm
almalinux9aarch64nodejs-full-i18n< 18.20.4-1.module_el9.4.0+112+bb28ff81nodejs-full-i18n-18.20.4-1.module_el9.4.0+112+bb28ff81.aarch64.rpm
almalinux9aarch64nodejs-devel< 18.20.4-1.module_el9.4.0+112+bb28ff81nodejs-devel-18.20.4-1.module_el9.4.0+112+bb28ff81.aarch64.rpm
almalinux9x86_64nodejs-full-i18n< 18.20.4-1.module_el9.4.0+112+bb28ff81nodejs-full-i18n-18.20.4-1.module_el9.4.0+112+bb28ff81.x86_64.rpm
almalinux9x86_64nodejs< 18.20.4-1.module_el9.4.0+112+bb28ff81nodejs-18.20.4-1.module_el9.4.0+112+bb28ff81.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	9	noarch	nodejs-nodemon	< 3.0.1-1.module_el9.2.0+36+853e48f5	nodejs-nodemon-3.0.1-1.module_el9.2.0+36+853e48f5.noarch.rpm
almalinux	9	noarch	nodejs-packaging	< 2021.06-4.module_el9.1.0+13+d9a595ea	nodejs-packaging-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux	9	noarch	nodejs-packaging-bundler	< 2021.06-4.module_el9.1.0+13+d9a595ea	nodejs-packaging-bundler-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux	9	noarch	nodejs-docs	< 18.20.4-1.module_el9.4.0+112+bb28ff81	nodejs-docs-18.20.4-1.module_el9.4.0+112+bb28ff81.noarch.rpm
almalinux	9	aarch64	nodejs	< 18.20.4-1.module_el9.4.0+112+bb28ff81	nodejs-18.20.4-1.module_el9.4.0+112+bb28ff81.aarch64.rpm
almalinux	9	aarch64	npm	< 10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81	npm-10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81.aarch64.rpm
almalinux	9	aarch64	nodejs-full-i18n	< 18.20.4-1.module_el9.4.0+112+bb28ff81	nodejs-full-i18n-18.20.4-1.module_el9.4.0+112+bb28ff81.aarch64.rpm
almalinux	9	aarch64	nodejs-devel	< 18.20.4-1.module_el9.4.0+112+bb28ff81	nodejs-devel-18.20.4-1.module_el9.4.0+112+bb28ff81.aarch64.rpm
almalinux	9	x86_64	nodejs-full-i18n	< 18.20.4-1.module_el9.4.0+112+bb28ff81	nodejs-full-i18n-18.20.4-1.module_el9.4.0+112+bb28ff81.x86_64.rpm
almalinux	9	x86_64	nodejs	< 18.20.4-1.module_el9.4.0+112+bb28ff81	nodejs-18.20.4-1.module_el9.4.0+112+bb28ff81.x86_64.rpm