Moderate: nodejs:12 security, bug fix, and enhancement update
Summary
ALSA-2021:3073: Moderate: nodejs:12 security, bug fix, and enhancement update. Affects nodejs-nodemon versions < 2.0.3-1.module_el8.4.0+2521+c668cc9f. Fixed in 2.0.3-1.module_el8.4.0+2521+c668cc9f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications. Node.js provides an event-driven architecture and non-blocking I/O model, making it efficient and suitable for handling concurrent requests. The package 'nodejs' is a core component of the Node.js platform and includes the runtime environment and various modules for building applications. This vulnerability affects version 12 of the 'nodejs' package.
Vulnerability Detail
The 'nodejs' package version 12 is affected by multiple security vulnerabilities:
-
CVE-2021-23362: This vulnerability exists in the 'nodejs-hosted-git-info' package and can be exploited through a Regular Expression Denial of Service (ReDoS) attack. An attacker can cause a denial of service by sending a specially crafted request, leading to high CPU usage and potentially impacting the availability of the application.
-
CVE-2021-27290: This vulnerability is present in the 'nodejs-ssri' package and can be exploited through a Regular Expression Denial of Service (ReDoS) attack. An attacker can send a malicious request containing a specially crafted Subresource Integrity (SRI) value, causing the application to consume excessive CPU resources and potentially impacting its availability.
-
CVE-2021-22918: This vulnerability affects the 'libuv' library used by Node.js. It is caused by an out-of-bounds read in the 'uv__idna_toascii()' function. An attacker can exploit this vulnerability to disclose sensitive information or crash the application.
These vulnerabilities pose a moderate risk and can be exploited by remote attackers to disrupt the availability of the affected application or potentially disclose sensitive information.
How To Fix
Minimum fixed version
2.0.3-1.module_el8.4.0+2521+c668cc9f
This is the first release that contains the fix.
sudo dnf update nodejs-nodemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the 'nodejs' package version 12 is affected by multiple security vulnerabilities that can be exploited by remote attackers. To mitigate these vulnerabilities, it is crucial to update the package to version 12.22.3 or later. This update includes patches for the identified vulnerabilities and ensures the security of your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It provides an event-driven architecture and non-blocking I/O model, making it efficient for handling concurrent requests.
These vulnerabilities can be exploited by remote attackers to disrupt the availability of the affected application or potentially disclose sensitive information.
You can check the version of the 'nodejs' package by running the following command in a terminal or command prompt:
node -v
The output will display the version number.
No, there are no known workarounds for these vulnerabilities. It is recommended to update the 'nodejs' package to the latest version to ensure the security of your application.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and acknowledgments, on the respective CVE pages: CVE-2021-23362, CVE-2021-27290, and CVE-2021-22918.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
