Moderate: nodejs:14 security, bug fix, and enhancement update
Summary
ALSA-2023:0050: Moderate: nodejs:14 security, bug fix, and enhancement update. Affects nodejs versions < 1:14.21.1-2.module_el8.7.0+3373+a4c18c43. Fixed in 1:14.21.1-2.module_el8.7.0+3373+a4c18c43. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications. Node.js provides an event-driven architecture and a non-blocking I/O model, making it efficient and suitable for handling concurrent requests. The package in question, nodejs, is a core component of the Node.js platform.
Vulnerability Detail
The nodejs package has been found to have multiple security vulnerabilities that have been addressed in the latest update. These vulnerabilities include:
- CVE-2021-44906: A prototype pollution vulnerability in the minimist package, which could allow an attacker to modify an object's prototype and potentially execute arbitrary code.
- CVE-2022-0235: A sensitive information exposure vulnerability in the node-fetch package, which could allow an unauthorized actor to access sensitive information.
- CVE-2022-3517: A regular expression denial of service (ReDoS) vulnerability in the braceExpand function of the nodejs-minimatch package, which could lead to a denial of service attack.
- CVE-2022-24999: A prototype poisoning vulnerability in the qs package used by express, which could cause the node process to hang.
- CVE-2022-43548: A DNS rebinding vulnerability in the inspect feature of nodejs, which could allow an attacker to bypass security restrictions by using an invalid octal IP address.
These vulnerabilities could have various impacts, including remote code execution, information disclosure, denial of service, and bypassing security restrictions.
How To Fix
Minimum fixed version
1:14.21.1-2.module_el8.7.0+3373+a4c18c43
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the nodejs package has been found to have multiple security vulnerabilities that can be fixed by updating to the latest version. It is important to keep software dependencies up to date to mitigate the risk of potential security issues. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
These vulnerabilities could allow an attacker to execute arbitrary code, access sensitive information, cause denial of service, or bypass security restrictions.
To fix these vulnerabilities, update the nodejs package to version 14.21.1 or later.
No specific workarounds have been provided for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the original vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
