Lucene search

GoogleOSV:RLSA-2023:1743

HistoryApr 26, 2023 - 3:28 p.m.

Important: nodejs:14 security, bug fix, and enhancement update

2023-04-2615:28:13

Google

osv.dev

node.js programming language

cve-2022-38900

cve-2021-35065

cve-2022-3517

cve-2022-4904

cve-2022-25881

cve-2023-23918

cve-2023-23920

bug fix

enhancement

network applications

javascript

upstream version

buffer overflow

regular expression denial of service

security issue

cvss score

icu_data environment variable.

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

7.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.9%

JSON

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.21.3).

Security Fix(es):

decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)
glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.