RHSA-2023:2654: Moderate: nodejs:18 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (18.14.2).Security Fix(es): glob-parent: Regular Expression Denial of Service (CVE-2021-35065) c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904) http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881) Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918) Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919) Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936) Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920) Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:2654?
The severity of RHSA-2023:2654 has not been explicitly stated but is linked to vulnerabilities in the Node.js platform.
How do I fix RHSA-2023:2654?
To fix RHSA-2023:2654, upgrade the affected Node.js packages to the latest version as specified in the advisory.
What packages are affected by RHSA-2023:2654?
The affected packages include nodejs, nodejs-nodemon, nodejs-docs, and others as detailed in the advisory.
What is the version required to mitigate RHSA-2023:2654?
The required version to mitigate RHSA-2023:2654 is nodejs 18.14.2-2.module+el9.2.0 and associated package updates.
Is RHSA-2023:2654 related to security vulnerabilities?
Yes, RHSA-2023:2654 addresses security vulnerabilities associated with the Node.js platform.