Moderate: nodejs:18 security, bug fix, and enhancement update
Summary
ALSA-2022:8833: Moderate: nodejs:18 security, bug fix, and enhancement update. Affects nodejs versions < 1:18.12.1-2.module_el8.7.0+3370+40ccb2a8. Fixed in 1:18.12.1-2.module_el8.7.0+3370+40ccb2a8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It provides a runtime environment for executing JavaScript code on the server-side. Node.js is widely used for developing web servers, command-line tools, and other network applications. The vulnerability affects the nodejs package in AlmaLinux 8.
Vulnerability Detail
The vulnerability (CVE-2022-3517) in the nodejs package is a Regular Expression Denial of Service (ReDoS) vulnerability in the minimatch module. An attacker can exploit this vulnerability by providing a specially crafted input to the braceExpand function, leading to excessive backtracking and causing a denial of service. This vulnerability has a moderate impact and can be exploited remotely without authentication. Another vulnerability (CVE-2022-43548) affects the DNS rebinding functionality in the inspect module of nodejs. An attacker can use an invalid octal IP address to bypass DNS rebinding protections and potentially access sensitive information. This vulnerability also has a moderate impact and can be exploited remotely without authentication.
How To Fix
Minimum fixed version
1:18.12.1-2.module_el8.7.0+3370+40ccb2a8
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Node.js users on AlmaLinux 8 are advised to update the nodejs and nodejs-nodemon packages to the latest versions to address the identified vulnerabilities. Regularly updating packages is crucial to ensure the security and stability of the software.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
The ReDoS vulnerability in the minimatch module can lead to a denial of service by causing excessive backtracking.
The DNS rebinding vulnerability in the inspect module can be exploited by using an invalid octal IP address to bypass protections and potentially access sensitive information.
The recommended mitigation is to update the nodejs package to the latest version, which includes the necessary security patches.
Yes, both vulnerabilities can be exploited remotely without authentication.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
