Updated nodejs & yarnpkg packages fix security vulnerabilities

2024-08-2820:11:44

Gentoo Foundation

advisories.mageia.org

nodejs

yarnpkg

security vulnerabilities

cve

lts

bypass

network import

permission model

unix

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

Low

EPSS

Percentile

16.3%

JSON

Nodejs 22 is the new active LTS branch and 5 CVE are fixed. CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) CVE-2024-22020 - Bypass network import restriction via data URL (Medium) CVE-2024-22018 - fs.lstat bypasses permission model (Low) CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low) CVE-2024-37372 - Permission model improperly processes UNC paths (Low) yarn package is updated with npm 10.8.2

OSVersionArchitecturePackageVersionFilename
Mageia9noarchnodejs< 22.6.0-1nodejs-22.6.0-1.mga9
Mageia9noarchyarnpkg< 1.22.22-0.10.8.2.1yarnpkg-1.22.22-0.10.8.2.1.mga9