RHSA-2023:4331: Moderate: nodejs security, bug fix, and enhancement update
Moderate: nodejs security, bug fix, and enhancement update
Other sources
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The package has been upgraded to a later upstream version: nodejs (16.20.1). (BZ#2223334, BZ#2223336, BZ#2223338, BZ#2223340, BZ#2223342, BZ#2223344)Security Fix(es): nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581) nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588) nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589) nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:4331?
The severity of RHSA-2023:4331 is medium.
What software is affected by RHSA-2023:4331?
The Red Hat Enterprise Linux for ARM 64, Red Hat Enterprise Linux for Power, little endian, and various nodejs packages are affected by RHSA-2023:4331.
How do I fix RHSA-2023:4331?
To fix RHSA-2023:4331, upgrade your nodejs packages to version 16.20.1-1.el9_2 or later.
Where can I find more information about RHSA-2023:4331?
You can find more information about RHSA-2023:4331 on the Red Hat Errata page: https://access.redhat.com/errata/RHSA-2023:4331
Are there any known bugs related to RHSA-2023:4331?
Yes, there are two known bugs related to RHSA-2023:4331. You can find more information about them on the Red Hat Bugzilla page: https://bugzilla.redhat.com/show_bug.cgi?id=2219824 and https://bugzilla.redhat.com/show_bug.cgi?id=2219838