Moderate: nodejs:20 security update
Summary
ALSA-2024:5814: Moderate: nodejs:20 security update. Affects nodejs versions < 1:20.16.0-1.module_el8.10.0+3882+e12e42db. Fixed in 1:20.16.0-1.module_el8.10.0+3882+e12e42db. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model. Node.js allows developers to write JavaScript code that runs on the server, enabling efficient and high-performance application development.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the Node.js package. The vulnerabilities include:
-
Denial of service vulnerability in node-tar: This vulnerability allows an attacker to cause a denial of service by providing a specially crafted tar file that triggers a parsing error due to a lack of folders depth validation.
-
Bypass network import restriction via data URL: This vulnerability allows an attacker to bypass network import restrictions by using a data URL to import malicious code.
-
Bypass permission model in fs.lstat: This vulnerability allows an attacker to bypass the permission model in the fs.lstat function, potentially leading to unauthorized access to files.
-
Bypass permission model in fs.fchown/fchmod: This vulnerability allows an attacker to bypass the permission model in the fs.fchown and fs.fchmod functions, potentially leading to unauthorized modification of file permissions.
These vulnerabilities can be exploited by remote attackers to cause denial of service, bypass security restrictions, and gain unauthorized access or modify file permissions.
How To Fix
Minimum fixed version
1:20.16.0-1.module_el8.10.0+3882+e12e42db
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
Node.js is a popular software development platform used for building network applications. This security update addresses multiple vulnerabilities that could be exploited by remote attackers. It is crucial to update the affected Node.js package to the recommended version to ensure the security and integrity of the applications built using Node.js.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The vulnerabilities addressed in this security update include a denial of service vulnerability in node-tar, a bypass network import restriction vulnerability via data URL, and two bypass permission model vulnerabilities in fs.lstat and fs.fchown/fchmod.
These vulnerabilities can be exploited by remote attackers to cause denial of service, bypass security restrictions, and gain unauthorized access or modify file permissions.
To fix these vulnerabilities, it is recommended to update the affected Node.js package to version 20.16.0-1.module_el8.10.0+3882+e12e42db or later.
There are no mentioned workarounds for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
