Important: Security Update for Node.js
Summary
ALSA-2024:1688: Important: nodejs:20 security update. Affects nodejs versions < 1:20.11.1-1.module_el9.3.0+88+29afeaa2. Fixed in 1:20.11.1-1.module_el9.3.0+88+29afeaa2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform that allows developers to build fast and scalable network applications using JavaScript. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model. However, several security vulnerabilities have been identified in Node.js that could potentially compromise the security and stability of applications built on this platform.
Vulnerability Detail
One of the vulnerabilities affecting Node.js is a timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin). This vulnerability could allow an attacker to decrypt encrypted data by exploiting the timing differences in the decryption process. Another vulnerability allows an attacker to perform denial-of-service attacks by sending unprocessed HTTP requests with unbounded chunk extensions. Additionally, there are vulnerabilities that enable code injection and privilege escalation through Linux capabilities, path traversal by monkey-patching buffer internals, and multiple permission model bypasses due to improper path traversal sequence sanitization. Another vulnerability arises from the improper handling of wildcards in certain command-line options, which could lead to unauthorized file system access. Finally, the setuid() function in Node.js does not drop all privileges due to an issue with io_uring, which could result in privilege escalation.
How To Fix
Minimum fixed version
1:20.11.1-1.module_el9.3.0+88+29afeaa2
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is crucial to update Node.js to the latest version as soon as possible to mitigate the risks associated with these vulnerabilities.
Conclusion
Node.js is a widely used software development platform, but it is not immune to security vulnerabilities. It is important to stay updated with the latest security patches and regularly update Node.js to ensure the security and stability of your applications. If you need further assistance or support in addressing these vulnerabilities, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The security vulnerabilities in Node.js include a timing variant of the Bleichenbacher attack, unprocessed HTTP request vulnerability, code injection and privilege escalation through Linux capabilities, path traversal vulnerability, multiple permission model bypasses, improper handling of wildcards, and incomplete privilege dropping in the setuid() function.
These vulnerabilities could allow attackers to decrypt encrypted data, perform denial-of-service attacks, execute arbitrary code with elevated privileges, access unauthorized files, and escalate privileges.
To fix these vulnerabilities, update Node.js to version 20.11.1-1.module_el9.3.0+88+29afeaa2 or later. Follow the instructions provided by the Node.js documentation or use package management tools specific to your operating system.
There are no specific workarounds mentioned for these vulnerabilities. It is crucial to update Node.js to the latest version to mitigate the risks associated with these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
