Lucene search
IBM65FD8B34226EC777D11D14977EFD4CBA1E4D8568AB599BC0C0CEE63C0E4684D4HistoryJan 11, 2022 - 8:10 p.m.
Security Bulletin: Vulnerabilitiy affects IBM Observability with Instana
2022-01-1120:10:06
www.ibm.com
94
ibm observability
instana
cve-2021-22940
node.js
security
vulnerability
update
EPSS
0.009
Percentile
82.8%
Summary
Vulnerabilities detected in Node.js versions before v14.17.5 affects IBM Observability with Instana
Vulnerability Details
CVEID:CVE-2021-22940
**DESCRIPTION:**Node.js could allow a remote attacker to bypass security restrictions, caused by an incomplete fix for CVE-2021-22930 related to a use-after-free on close http2 on stream canceling. An attacker could exploit this vulnerability to corrupt memory to change process behavior.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/207520 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Observability with Instana (OnPrem) | All |
Remediation/Fixes
Update your existing installation of IBM Observability with Instana as described here: <https://www.instana.com/docs/self_hosted_instana/operations#upgrade-your-container-based-installation>
Workarounds and Mitigations
None
Related
redhatcve
redhatcve
CVE-2021-22940
2021-08-12 10:21:15
CVE-2021-22930
2021-07-30 14:01:23
ibm
ibm
Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to memory corruption due to CVE-2021-22940
2021-10-20 10:08:49
nodejsblog
nodejsblog
August 2021 Security Releases
2021-08-11 00:00:00
July 2021 Security Releases
2021-07-29 00:00:00
freebsd
freebsd
Node.js -- August 2021 Security Releases
2021-08-11 00:00:00
Node.js -- July 2021 Security Releases (2)
2021-07-29 00:00:00
nessus
nessus
FreeBSD : Node.js -- August 2021 Security Releases (b092bd4f-1b16-11ec-9d9d-0022489ad614)
2021-10-01 00:00:00
openSUSE 15 Security Update : nodejs12 (openSUSE-SU-2021:2875-1)
2021-09-02 00:00:00
openSUSE 15 Security Update : nodejs14 (openSUSE-SU-2021:1313-1)
2021-09-29 00:00:00
openvas
openvas
openSUSE: Security Advisory for nodejs14 (openSUSE-SU-2021:3211-1)
2021-09-24 00:00:00
openSUSE: Security Advisory for nodejs12 (openSUSE-SU-2021:2875-1)
2021-08-31 00:00:00
openSUSE: Security Advisory for nodejs14 (openSUSE-SU-2021:1313-1)
2021-09-29 00:00:00
archlinux
archlinux
[ASA-202110-6] nodejs-lts-erbium: multiple issues
2021-10-21 00:00:00
[ASA-202110-5] nodejs-lts-fermium: multiple issues
2021-10-21 00:00:00
[ASA-202108-2] nodejs-lts-fermium: arbitrary code execution
2021-08-03 00:00:00
osv
osv
nodejs16-16.6.2-2.2 on GA media
2024-06-15 00:00:00
nodejs - security update
2022-10-05 00:00:00
BIT-node-2021-22940
2024-03-06 11:06:08
suse
suse
Security update for nodejs12 (important)
2021-08-30 00:00:00
Security update for nodejs14 (important)
2021-09-23 00:00:00
Security update for nodejs12 (important)
2021-08-31 00:00:00
ubuntucve
ubuntucve
CVE-2021-22940
2021-08-16 00:00:00
CVE-2021-22930
2021-10-07 00:00:00
prion
prion
Memory corruption
2021-08-16 19:15:00
Memory corruption
2021-10-07 14:15:00
cbl_mariner
cbl_mariner
CVE-2021-22940 affecting package nodejs for versions less than 16.14.0-1
2022-04-09 06:52:23
CVE-2021-22940 affecting package nodejs 14.17.2-1
2021-09-09 15:03:07
CVE-2021-22930 affecting package nodejs for versions less than 16.14.0-1
2022-04-09 06:52:23
debiancve
debiancve
CVE-2021-22940
2021-08-16 19:15:13
CVE-2021-22930
2021-10-07 14:15:08
nvd
nvd
CVE-2021-22940
2021-08-16 19:15:13
CVE-2021-22930
2021-10-07 14:15:08
altlinux
altlinux
Security fix for the ALT Linux 10 package node version 14.17.4-alt1
2021-08-02 00:00:00
Security fix for the ALT Linux 10 package node version 14.17.5-alt1
2021-08-17 00:00:00
veracode
veracode
Denial Of Service (DoS)
2021-07-30 09:51:03
Denial Of Service (DoS)
2021-08-12 23:16:54
cvelist
cvelist
CVE-2021-22940
2021-08-16 00:00:00
CVE-2021-22930
2021-10-07 00:00:00
cve
cve
CVE-2021-22940
2021-08-16 19:15:13
CVE-2021-22930
2021-10-07 14:15:08
alpinelinux
alpinelinux
CVE-2021-22930
2021-10-07 14:15:08
mageia
mageia
Updated nodejs packages fix security vulnerability
2021-08-06 12:33:48
Updated nodejs packages fix security vulnerability
2021-10-06 22:41:56
debian
debian
[SECURITY] [DLA 3137-1] nodejs security update
2022-10-05 15:18:22
gentoo
gentoo
c-ares: Multiple Vulnerabilities
2024-01-05 00:00:00
Node.js: Multiple Vulnerabilities
2024-05-08 00:00:00
almalinux
almalinux
Important: nodejs:12 security and bug fix update
2021-09-21 12:33:58
Important: nodejs:14 security and bug fix update
2021-09-27 06:47:35
rocky
rocky
nodejs:14 security and bug fix update
2021-09-27 06:47:35
nodejs:12 security and bug fix update
2021-09-21 12:33:58
redhat
redhat
(RHSA-2021:3623) Important: nodejs:12 security and bug fix update
2021-09-21 12:33:58
(RHSA-2021:3666) Important: nodejs:14 security and bug fix update
2021-09-27 06:47:35
oraclelinux
oraclelinux
nodejs:12 security and bug fix update
2021-09-22 00:00:00
nodejs:14 security and bug fix update
2021-09-27 00:00:00
photon
photon
Critical Photon OS Security Update - PHSA-2021-0090
2021-08-27 00:00:00
Critical Photon OS Security Update - PHSA-2021-4.0-0090
2021-08-27 00:00:00
ics
ics
Siemens SINEC INS
2022-03-10 12:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00
Oracle Critical Patch Update Advisory - January 2022
2022-01-18 00:00:00
Oracle Critical Patch Update Advisory - October 2021
2021-10-19 00:00:00
EPSS
0.009
Percentile
82.8%
Related for 65FD8B34226EC777D11D14977EFD4CBA1E4D8568AB599BC0C0CEE63C0E4684D4