Lucene search

K
mageiaGentoo FoundationMGASA-2023-0226
HistoryJul 07, 2023 - 8:54 a.m.

Updated nodejs packages fix security vulnerability

2023-07-0708:54:45
Gentoo Foundation
advisories.mageia.org
23
node.js
upgrade
security
cve
openssl
c-ares
unix

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.002

Percentile

58.1%

Current nodejs 14 branch in Mageia 8 is end of life and there are no more security updates. This release allows to move to the new nodejs 18 LTS branch and fixes the following CVEs CVE-2023-30581: mainModule.proto Bypass Experimental Policy Mechanism (High) CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium) CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium) CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium) OpenSSL Security Releases OpenSSL security advisory 28th March. OpenSSL security advisory 20th April. OpenSSL security advisory 30th May c-ares vulnerabilities: GHSA-9g78-jv2r-p7vc GHSA-8r8p-23f3-64c2 GHSA-54xr-f67r-4pc4 GHSA-x6mf-cxr9-8q6v

OSVersionArchitecturePackageVersionFilename
Mageia8noarchnodejs< 18.16.1-1nodejs-18.16.1-1.mga8

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.002

Percentile

58.1%