Action not permitted
Modal body text goes here.
CVE-2021-35065
Vulnerability from cvelistv5
Published
2022-12-26 00:00
Modified
2024-08-04 00:33
Severity ?
EPSS score ?
Summary
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
References
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339 | Patch, Third Party Advisory | |
cve@mitre.org | https://github.com/gulpjs/glob-parent/pull/49 | Exploit, Patch, Third Party Advisory | |
cve@mitre.org | https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294 | Exploit, Third Party Advisory |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T00:33:50.984Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "url": "https://security.netapp.com/advisory/ntap-20230214-0010/" }, { "tags": [ "x_transferred" ], "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" }, { "tags": [ "x_transferred" ], "url": "https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339" }, { "tags": [ "x_transferred" ], "url": "https://github.com/gulpjs/glob-parent/pull/49" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2022-12-26T00:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" }, { "url": "https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339" }, { "url": "https://github.com/gulpjs/glob-parent/pull/49" } ] } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-35065", "datePublished": "2022-12-26T00:00:00", "dateReserved": "2021-06-21T00:00:00", "dateUpdated": "2024-08-04T00:33:50.984Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2021-35065\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-12-26T07:15:11.730\",\"lastModified\":\"2023-01-23T18:32:24.010\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.\"},{\"lang\":\"es\",\"value\":\"El paquete glob-parent anterior a 6.0.1 para Node.js permite ataques ReDoS (Denegaci\u00f3n de Servicio (DoS) de expresi\u00f3n regular) contra la expresi\u00f3n regular del recinto.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gulpjs:glob-parent:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.1\",\"matchCriteriaId\":\"89D4AC09-A67D-4F86-B6A3-7BD266105561\"}]}]}],\"references\":[{\"url\":\"https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/gulpjs/glob-parent/pull/49\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}" } }
ghsa-cj88-88mr-972w
Vulnerability from github
Published
2022-07-18 17:03
Modified
2023-01-06 03:13
Severity ?
Summary
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service
Details
glob-parent 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1.
This vulnerability is separate from GHSA-ww39-953v-wcq6.
{ "affected": [ { "package": { "ecosystem": "npm", "name": "glob-parent" }, "ranges": [ { "events": [ { "introduced": "6.0.0" }, { "fixed": "6.0.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "6.0.0" ] } ], "aliases": [ "CVE-2021-35065" ], "database_specific": { "cwe_ids": [ "CWE-1333", "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2022-07-18T17:03:23Z", "nvd_published_at": "2022-12-26T07:15:00Z", "severity": "HIGH" }, "details": "glob-parent 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1.\n\nThis vulnerability is separate from [GHSA-ww39-953v-wcq6](https://github.com/advisories/GHSA-ww39-953v-wcq6).", "id": "GHSA-cj88-88mr-972w", "modified": "2023-01-06T03:13:53Z", "published": "2022-07-18T17:03:23Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "type": "WEB", "url": "https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1103" }, { "type": "WEB", "url": "https://github.com/gulpjs/glob-parent/pull/49" }, { "type": "WEB", "url": "https://github.com/gulpjs/glob-parent/commit/32f6d52663b7addac38d0dff570d8127edf03f47" }, { "type": "WEB", "url": "https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339" }, { "type": "PACKAGE", "url": "https://github.com/gulpjs/glob-parent" }, { "type": "WEB", "url": "https://github.com/gulpjs/glob-parent/releases/tag/v6.0.1" }, { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" }, { "type": "WEB", "url": "https://www.mend.io/vulnerability-database/CVE-2021-35065" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service" }
wid-sec-w-2023-0328
Vulnerability from csaf_certbund
Published
2023-02-09 23:00
Modified
2024-05-01 22:00
Summary
Red Hat OpenShift: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.
Angriff
Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen oder Daten zu manipulieren.
Betroffene Betriebssysteme
- Linux
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Red Hat OpenShift ist eine \"Platform as a Service\" (PaaS) L\u00f6sung zur Bereitstellung von Applikationen in der Cloud.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren oder Daten zu manipulieren.", "title": "Angriff" }, { "category": "general", "text": "- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0328 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0328.json" }, { "category": "self", "summary": "WID-SEC-2023-0328 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0328" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0634 vom 2023-02-09", "url": "https://access.redhat.com/errata/RHSA-2023:0634" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0934 vom 2023-02-28", "url": "https://access.redhat.com/errata/RHSA-2023:0934" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1047 vom 2023-03-02", "url": "https://access.redhat.com/errata/RHSA-2023:1047" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1045 vom 2023-03-02", "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1044 vom 2023-03-02", "url": "https://access.redhat.com/errata/RHSA-2023:1044" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1043 vom 2023-03-02", "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1049 vom 2023-03-02", "url": "https://access.redhat.com/errata/RHSA-2023:1049" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1428 vom 2023-03-23", "url": "https://access.redhat.com/errata/RHSA-2023:1428" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1743 vom 2023-04-12", "url": "https://access.redhat.com/errata/RHSA-2023:1743" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1742 vom 2023-04-12", "url": "https://access.redhat.com/errata/RHSA-2023:1742" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6758-1 vom 2024-04-30", "url": "https://ubuntu.com/security/notices/USN-6758-1" } ], "source_lang": "en-US", "title": "Red Hat OpenShift: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-01T22:00:00.000+00:00", "generator": { "date": "2024-05-02T08:40:58.351+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-0328", "initial_release_date": "2023-02-09T23:00:00.000+00:00", "revision_history": [ { "date": "2023-02-09T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-02-27T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-03-01T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-03-22T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-04-12T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-05-01T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Ubuntu aufgenommen" } ], "status": "final", "version": "6" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "branches": [ { "category": "product_version", "name": "logging", "product": { "name": "Red Hat OpenShift logging", "product_id": "T026215", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:logging" } } } ], "category": "product_name", "name": "OpenShift" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in Red Hat OpenShift. Diese besteht in der Komponente \"glob-parent package\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "67646", "T000126", "T026215" ] }, "release_date": "2023-02-09T23:00:00Z", "title": "CVE-2021-35065" }, { "cve": "CVE-2022-46175", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in Red Hat OpenShift. Diese besteht in der Komponente \"json5\" und ist auf einen Fehler zur\u00fcckzuf\u00fchren, der eine Prototype Pollution erm\u00f6glicht. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um Daten zu manipulieren." } ], "product_status": { "known_affected": [ "67646", "T000126", "T026215" ] }, "release_date": "2023-02-09T23:00:00Z", "title": "CVE-2022-46175" } ] }
rhsa-2023_1047
Vulnerability from csaf_redhat
Published
2023-03-01 21:46
Modified
2024-11-25 05:50
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
Notes
Topic
A new image is available for Red Hat Single Sign-On 7.6.2, running on Red
Hat OpenShift Container Platform from the release of 3.11 up to the release
of 4.12.0.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On is an integrated sign-on solution, available as a
Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat
Single Sign-On for OpenShift image provides an authentication server that
you can use to log in centrally, log out, and register. You can also manage
user accounts for web applications, mobile applications, and RESTful web
services.
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* keycloak: path traversal via double URL encoding (CVE-2022-3782)
* RH-SSO for OpenShift images: unsecured management interface exposed to adjacent network (CVE-2022-4039)
* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* keycloak: minimist: prototype pollution (CVE-2021-44906)
* keycloak: missing email notification template allowlist (CVE-2022-1274)
* keycloak: XSS on izmpersonation under specific circumstances (CVE-2022-1438)
* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)
* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
This erratum releases a new image for Red Hat Single Sign-On 7.6.2 for use
within the Red Hat OpenShift Container Platform (from the release of 3.11
up to the release of 4.12.0) cloud computing Platform-as-a-Service (PaaS)
for on-premise or private cloud deployments, aligning with the standalone
product release.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A new image is available for Red Hat Single Sign-On 7.6.2, running on Red\nHat OpenShift Container Platform from the release of 3.11 up to the release\nof 4.12.0.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On is an integrated sign-on solution, available as a\nRed Hat JBoss Middleware for OpenShift containerized image. The Red Hat\nSingle Sign-On for OpenShift image provides an authentication server that\nyou can use to log in centrally, log out, and register. You can also manage\nuser accounts for web applications, mobile applications, and RESTful web\nservices.\n\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n* RH-SSO for OpenShift images: unsecured management interface exposed to adjacent network (CVE-2022-4039)\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* keycloak: minimist: prototype pollution (CVE-2021-44906)\n* keycloak: missing email notification template allowlist (CVE-2022-1274)\n* keycloak: XSS on izmpersonation under specific circumstances (CVE-2022-1438)\n* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)\n* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)\n* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)\n\nThis erratum releases a new image for Red Hat Single Sign-On 7.6.2 for use\nwithin the Red Hat OpenShift Container Platform (from the release of 3.11\nup to the release of 4.12.0) cloud computing Platform-as-a-Service (PaaS)\nfor on-premise or private cloud deployments, aligning with the standalone\nproduct release.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1047", "url": "https://access.redhat.com/errata/RHSA-2023:1047" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "2143416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143416" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1047.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update", "tracking": { "current_release_date": "2024-11-25T05:50:37+00:00", "generator": { "date": "2024-11-25T05:50:37+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1047", "initial_release_date": "2023-03-01T21:46:46+00:00", "revision_history": [ { "date": "2023-03-01T21:46:46+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-01T21:46:46+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-25T05:50:37+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Middleware Containers for OpenShift", "product": { "name": "Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhosemc:1.0::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21?arch=s390x\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-20" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60?arch=ppc64le\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-20" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f?arch=amd64\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-20" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "relates_to_product_reference": "8Base-RHOSE-Middleware" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64 as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "relates_to_product_reference": "8Base-RHOSE-Middleware" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x", "relates_to_product_reference": "8Base-RHOSE-Middleware" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "acknowledgments": [ { "names": [ "Marcus Nilsson" ], "organization": "usd AG" } ], "cve": "CVE-2022-1274", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073157" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: HTML injection in execute-actions-email Admin REST API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1274" }, { "category": "external", "summary": "RHBZ#2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1274" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725" } ], "release_date": "2023-02-28T18:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: HTML injection in execute-actions-email Admin REST API" }, { "acknowledgments": [ { "names": [ "Grzegorz Tworek" ], "organization": "SISOFT s.c." } ], "cve": "CVE-2022-1438", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2021-12-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2031904" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS on impersonation under specific circumstances", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1438" }, { "category": "external", "summary": "RHBZ#2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1438", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1438" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438" } ], "release_date": "2023-02-28T18:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS on impersonation under specific circumstances" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-2764", "discovery_date": "2022-08-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2117506" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK from the bytes, causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2764" }, { "category": "external", "summary": "RHBZ#2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2764", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2764" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764" } ], "release_date": "2022-08-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations" }, { "cve": "CVE-2022-3782", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-10-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2138971" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: path traversal via double URL encoding", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not impacted as this CVE affects the server-side Keycloak execution but Quarkus only acts as a Keycloak client in its quarkus-keycloak-authorization extension. For this reason Quarkus is marked with Low impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3782" }, { "category": "external", "summary": "RHBZ#2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3782", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3782" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3782", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3782" } ], "release_date": "2022-12-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: path traversal via double URL encoding" }, { "acknowledgments": [ { "names": [ "Peter Flintholm" ], "organization": "Trifork" } ], "cve": "CVE-2022-3916", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2022-11-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2141404" } ], "notes": [ { "category": "description", "text": "A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Session takeover with OIDC offline refreshtokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3916" }, { "category": "external", "summary": "RHBZ#2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3916" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916" } ], "release_date": "2022-11-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: Session takeover with OIDC offline refreshtokens" }, { "acknowledgments": [ { "names": [ "Thibault Guittet" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2022-4039", "cwe": { "id": "CWE-276", "name": "Incorrect Default Permissions" }, "discovery_date": "2022-11-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2143416" } ], "notes": [ { "category": "description", "text": "A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.", "title": "Vulnerability description" }, { "category": "summary", "text": "rhsso-container-image: unsecured management interface exposed to adjecent network", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4039" }, { "category": "external", "summary": "RHBZ#2143416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143416" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4039", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4039" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4039", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4039" } ], "release_date": "2023-02-28T21:26:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "rhsso-container-image: unsecured management interface exposed to adjecent network" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-31129", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-07-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2105075" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service (ReDoS) attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "moment: inefficient parsing algorithm resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse provides the affected software but does not use the functionality and as such its impact has been downgraded to Low.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships a vulnerable version of the moment library. However, this affected functionality is restricted behind OAuth, reducing the impact to Moderate.\n\nRed Hat Satellite ships a vulnerable version of the moment library. However, this only affects a specific component (qpid-dispatch), reducing the impact to Moderate.\n\nRed Hat Ceph Storage (RHCS) ships a vulnerable version of the moment library, however, it is not directly used and is a transitive dependency from Angular. In addition, the impact would only be to the grafana browser, and not the underlying RHCS system, which reduces the impact to Moderate. \n\nRed Hat OpenShift Service Mesh (OSSM) ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nRed Hat OpenShift distributed tracing ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nIn Logging Subsystem for Red Hat OpenShift the vulnerable moment nodejs package is bundled in the ose-logging-kibana6 container as a transitive dependency, hence the direct impact is reduced to Moderate.\n\nIn OpenShift Container Platform 4 the vulnerabile moment package is a third party dependency, hence the direct impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31129" }, { "category": "external", "summary": "RHBZ#2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31129", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g", "url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g" } ], "release_date": "2022-07-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "moment: inefficient parsing algorithm resulting in DoS" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-38749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129706" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38749" }, { "category": "external", "summary": "RHBZ#2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38749", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode" }, { "cve": "CVE-2022-38750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129707" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38750" }, { "category": "external", "summary": "RHBZ#2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38750", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject" }, { "cve": "CVE-2022-38751", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129709" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38751" }, { "category": "external", "summary": "RHBZ#2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "CXF: SSRF Vulnerability" }, { "acknowledgments": [ { "names": [ "Sourav Kumar" ], "organization": "https://github.com/souravs17031999", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0091", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Client Registration endpoint does not check token revocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0091" }, { "category": "external", "summary": "RHBZ#2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0091", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0091" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg" }, { "category": "external", "summary": "https://github.com/keycloak/security/issues/27", "url": "https://github.com/keycloak/security/issues/27" } ], "release_date": "2022-10-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: Client Registration endpoint does not check token revocation" }, { "acknowledgments": [ { "names": [ "Jordi Zayuelas i Mu\u00f1oz" ], "organization": "A1 Digital", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0264", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2023-01-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2160585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: user impersonation via stolen uuid code", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0264" }, { "category": "external", "summary": "RHBZ#2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0264", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0264" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264" } ], "release_date": "2023-02-28T18:58:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: user impersonation via stolen uuid code" } ] }
rhsa-2023_0634
Vulnerability from csaf_redhat
Published
2023-02-09 14:01
Modified
2024-11-24 20:42
Summary
Red Hat Security Advisory: Red Hat OpenShift (Logging Subsystem) security update
Notes
Topic
Logging Subsystem 5.6.1 - Red Hat OpenShift
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Logging Subsystem 5.6.1 - Red Hat OpenShift
Security Fix(es):
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Logging Subsystem 5.6.1 - Red Hat OpenShift\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Logging Subsystem 5.6.1 - Red Hat OpenShift\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0634", "url": "https://access.redhat.com/errata/RHSA-2023:0634" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "LOG-3397", "url": "https://issues.redhat.com/browse/LOG-3397" }, { "category": "external", "summary": "LOG-3441", "url": "https://issues.redhat.com/browse/LOG-3441" }, { "category": "external", "summary": "LOG-3463", "url": "https://issues.redhat.com/browse/LOG-3463" }, { "category": "external", "summary": "LOG-3477", "url": "https://issues.redhat.com/browse/LOG-3477" }, { "category": "external", "summary": "LOG-3494", "url": "https://issues.redhat.com/browse/LOG-3494" }, { "category": "external", "summary": "LOG-3496", "url": "https://issues.redhat.com/browse/LOG-3496" }, { "category": "external", "summary": "LOG-3510", "url": "https://issues.redhat.com/browse/LOG-3510" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0634.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift (Logging Subsystem) security update", "tracking": { "current_release_date": "2024-11-24T20:42:23+00:00", "generator": { "date": "2024-11-24T20:42:23+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:0634", "initial_release_date": "2023-02-09T14:01:04+00:00", "revision_history": [ { "date": "2023-02-09T14:01:04+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-02-09T14:01:04+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:42:23+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "RHOL 5.6 for RHEL 8", "product": { "name": "RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:logging:5.6::el8" } } } ], "category": "product_family", "name": "logging for Red Hat OpenShift" }, { "branches": [ { "category": "product_version", "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870_ppc64le", "product": { "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870_ppc64le", "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870_ppc64le", "product_identification_helper": { "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.6.1-13" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0_ppc64le", "product": { "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0_ppc64le", "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0_ppc64le", "product_identification_helper": { "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.6.1-3" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1_ppc64le", "product": { "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1_ppc64le", "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1_ppc64le", "product_identification_helper": { "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-331" } } }, { "category": "product_version", "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1_ppc64le", "product": { "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1_ppc64le", "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1_ppc64le", "product_identification_helper": { "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.1.0-91" } } }, { "category": "product_version", "name": "openshift-logging/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4_ppc64le", "product": { "name": "openshift-logging/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4_ppc64le", "product_id": "openshift-logging/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4_ppc64le", "product_identification_helper": { "purl": "pkg:oci/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-275" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299_ppc64le", "product": { "name": "openshift-logging/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299_ppc64le", "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299_ppc64le", "product_identification_helper": { "purl": "pkg:oci/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-285" } } }, { "category": "product_version", "name": "openshift-logging/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40_ppc64le", "product": { "name": "openshift-logging/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40_ppc64le", "product_id": "openshift-logging/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40_ppc64le", "product_identification_helper": { "purl": "pkg:oci/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.4.0-72" } } }, { "category": "product_version", "name": "openshift-logging/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88_ppc64le", "product": { "name": "openshift-logging/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88_ppc64le", "product_id": "openshift-logging/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88_ppc64le", "product_identification_helper": { "purl": "pkg:oci/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.14.6-80" } } }, { "category": "product_version", "name": "openshift-logging/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050_ppc64le", "product": { "name": "openshift-logging/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050_ppc64le", "product_id": "openshift-logging/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050_ppc64le", "product_identification_helper": { "purl": "pkg:oci/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-322" } } }, { "category": "product_version", "name": "openshift-logging/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd_ppc64le", "product": { "name": "openshift-logging/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd_ppc64le", "product_id": "openshift-logging/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd_ppc64le", "product_identification_helper": { "purl": "pkg:oci/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel8\u0026tag=v2.7.3-2" } } }, { "category": "product_version", "name": "openshift-logging/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030_ppc64le", "product": { "name": "openshift-logging/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030_ppc64le", "product_id": "openshift-logging/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030_ppc64le", "product_identification_helper": { "purl": "pkg:oci/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel8\u0026tag=v0.21.0-46" } } }, { "category": "product_version", "name": "openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le", "product": { "name": "openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le", "product_id": "openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le", "product_identification_helper": { "purl": "pkg:oci/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-view-plugin-rhel8\u0026tag=v5.6.1-8" } } }, { "category": "product_version", "name": "openshift-logging/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c_ppc64le", "product": { "name": "openshift-logging/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c_ppc64le", "product_id": "openshift-logging/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c_ppc64le", "product_identification_helper": { "purl": "pkg:oci/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel8-operator\u0026tag=v5.6.1-14" } } }, { "category": "product_version", "name": "openshift-logging/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb_ppc64le", "product": { "name": "openshift-logging/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb_ppc64le", "product_id": "openshift-logging/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb_ppc64le", "product_identification_helper": { "purl": "pkg:oci/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel8\u0026tag=v0.1.0-136" } } }, { "category": "product_version", "name": "openshift-logging/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729_ppc64le", "product": { "name": "openshift-logging/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729_ppc64le", "product_id": "openshift-logging/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729_ppc64le", "product_identification_helper": { "purl": "pkg:oci/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel8\u0026tag=v0.1.0-43" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604_arm64", "product": { "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604_arm64", "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604_arm64", "product_identification_helper": { "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.6.1-13" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea_arm64", "product": { "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea_arm64", "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea_arm64", "product_identification_helper": { "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.6.1-3" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e_arm64", "product": { "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e_arm64", "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e_arm64", "product_identification_helper": { "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-331" } } }, { "category": "product_version", "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef_arm64", "product": { "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef_arm64", "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef_arm64", "product_identification_helper": { "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.1.0-91" } } }, { "category": "product_version", "name": "openshift-logging/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5_arm64", "product": { "name": "openshift-logging/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5_arm64", "product_id": "openshift-logging/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5_arm64", "product_identification_helper": { "purl": "pkg:oci/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-275" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406_arm64", "product": { "name": "openshift-logging/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406_arm64", "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406_arm64", "product_identification_helper": { "purl": "pkg:oci/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-285" } } }, { "category": "product_version", "name": "openshift-logging/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593_arm64", "product": { "name": "openshift-logging/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593_arm64", "product_id": "openshift-logging/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593_arm64", "product_identification_helper": { "purl": "pkg:oci/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.4.0-72" } } }, { "category": "product_version", "name": "openshift-logging/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb_arm64", "product": { "name": "openshift-logging/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb_arm64", "product_id": "openshift-logging/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb_arm64", "product_identification_helper": { "purl": "pkg:oci/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.14.6-80" } } }, { "category": "product_version", "name": "openshift-logging/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268_arm64", "product": { "name": "openshift-logging/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268_arm64", "product_id": "openshift-logging/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268_arm64", "product_identification_helper": { "purl": "pkg:oci/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-322" } } }, { "category": "product_version", "name": "openshift-logging/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d_arm64", "product": { "name": "openshift-logging/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d_arm64", "product_id": "openshift-logging/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d_arm64", "product_identification_helper": { "purl": "pkg:oci/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel8\u0026tag=v2.7.3-2" } } }, { "category": "product_version", "name": "openshift-logging/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1_arm64", "product": { "name": "openshift-logging/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1_arm64", "product_id": "openshift-logging/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1_arm64", "product_identification_helper": { "purl": "pkg:oci/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel8\u0026tag=v0.21.0-46" } } }, { "category": "product_version", "name": "openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64", "product": { "name": "openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64", "product_id": "openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64", "product_identification_helper": { "purl": "pkg:oci/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/logging-view-plugin-rhel8\u0026tag=v5.6.1-8" } } }, { "category": "product_version", "name": "openshift-logging/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b_arm64", "product": { "name": "openshift-logging/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b_arm64", "product_id": "openshift-logging/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b_arm64", "product_identification_helper": { "purl": "pkg:oci/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel8-operator\u0026tag=v5.6.1-14" } } }, { "category": "product_version", "name": "openshift-logging/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8_arm64", "product": { "name": "openshift-logging/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8_arm64", "product_id": "openshift-logging/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8_arm64", "product_identification_helper": { "purl": "pkg:oci/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel8\u0026tag=v0.1.0-136" } } }, { "category": "product_version", "name": "openshift-logging/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a_arm64", "product": { "name": "openshift-logging/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a_arm64", "product_id": "openshift-logging/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a_arm64", "product_identification_helper": { "purl": "pkg:oci/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel8\u0026tag=v0.1.0-43" } } } ], "category": "architecture", "name": "arm64" }, { "branches": [ { "category": "product_version", "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a_amd64", "product": { "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a_amd64", "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a_amd64", "product_identification_helper": { "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.6.1-13" } } }, { "category": "product_version", "name": "openshift-logging/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c_amd64", "product": { "name": "openshift-logging/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c_amd64", "product_id": "openshift-logging/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c_amd64", "product_identification_helper": { "purl": "pkg:oci/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=v5.6.1-40" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c_amd64", "product": { "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c_amd64", "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c_amd64", "product_identification_helper": { "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.6.1-3" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf_amd64", "product": { "name": "openshift-logging/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf_amd64", "product_id": "openshift-logging/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf_amd64", "product_identification_helper": { "purl": "pkg:oci/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-operator-bundle\u0026tag=v5.6.1-33" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead_amd64", "product": { "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead_amd64", "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead_amd64", "product_identification_helper": { "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-331" } } }, { "category": "product_version", "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776_amd64", "product": { "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776_amd64", "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776_amd64", "product_identification_helper": { "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.1.0-91" } } }, { "category": "product_version", "name": "openshift-logging/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3_amd64", "product": { "name": "openshift-logging/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3_amd64", "product_id": "openshift-logging/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3_amd64", "product_identification_helper": { "purl": "pkg:oci/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-275" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598_amd64", "product": { "name": "openshift-logging/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598_amd64", "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598_amd64", "product_identification_helper": { "purl": "pkg:oci/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-285" } } }, { "category": "product_version", "name": "openshift-logging/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357_amd64", "product": { "name": "openshift-logging/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357_amd64", "product_id": "openshift-logging/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357_amd64", "product_identification_helper": { "purl": "pkg:oci/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.4.0-72" } } }, { "category": "product_version", "name": "openshift-logging/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e_amd64", "product": { "name": "openshift-logging/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e_amd64", "product_id": "openshift-logging/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e_amd64", "product_identification_helper": { "purl": "pkg:oci/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.14.6-80" } } }, { "category": "product_version", "name": "openshift-logging/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015_amd64", "product": { "name": "openshift-logging/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015_amd64", "product_id": "openshift-logging/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015_amd64", "product_identification_helper": { "purl": "pkg:oci/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-322" } } }, { "category": "product_version", "name": "openshift-logging/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a_amd64", "product": { "name": "openshift-logging/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a_amd64", "product_id": "openshift-logging/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a_amd64", "product_identification_helper": { "purl": "pkg:oci/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel8\u0026tag=v2.7.3-2" } } }, { "category": "product_version", "name": "openshift-logging/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791_amd64", "product": { "name": "openshift-logging/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791_amd64", "product_id": "openshift-logging/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791_amd64", "product_identification_helper": { "purl": "pkg:oci/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel8\u0026tag=v0.21.0-46" } } }, { "category": "product_version", "name": "openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64", "product": { "name": "openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64", "product_id": "openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64", "product_identification_helper": { "purl": "pkg:oci/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-view-plugin-rhel8\u0026tag=v5.6.1-8" } } }, { "category": "product_version", "name": "openshift-logging/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d_amd64", "product": { "name": "openshift-logging/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d_amd64", "product_id": "openshift-logging/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d_amd64", "product_identification_helper": { "purl": "pkg:oci/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-operator-bundle\u0026tag=v5.6.1-34" } } }, { "category": "product_version", "name": "openshift-logging/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01_amd64", "product": { "name": "openshift-logging/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01_amd64", "product_id": "openshift-logging/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01_amd64", "product_identification_helper": { "purl": "pkg:oci/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel8-operator\u0026tag=v5.6.1-14" } } }, { "category": "product_version", "name": "openshift-logging/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10_amd64", "product": { "name": "openshift-logging/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10_amd64", "product_id": "openshift-logging/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10_amd64", "product_identification_helper": { "purl": "pkg:oci/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel8\u0026tag=v0.1.0-136" } } }, { "category": "product_version", "name": "openshift-logging/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc_amd64", "product": { "name": "openshift-logging/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc_amd64", "product_id": "openshift-logging/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc_amd64", "product_identification_helper": { "purl": "pkg:oci/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel8\u0026tag=v0.1.0-43" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e_s390x", "product": { "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e_s390x", "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e_s390x", "product_identification_helper": { "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.6.1-13" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a_s390x", "product": { "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a_s390x", "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a_s390x", "product_identification_helper": { "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.6.1-3" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7_s390x", "product": { "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7_s390x", "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7_s390x", "product_identification_helper": { "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-331" } } }, { "category": "product_version", "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f_s390x", "product": { "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f_s390x", "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f_s390x", "product_identification_helper": { "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.1.0-91" } } }, { "category": "product_version", "name": "openshift-logging/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46_s390x", "product": { "name": "openshift-logging/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46_s390x", "product_id": "openshift-logging/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46_s390x", "product_identification_helper": { "purl": "pkg:oci/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-275" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675_s390x", "product": { "name": "openshift-logging/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675_s390x", "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675_s390x", "product_identification_helper": { "purl": "pkg:oci/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-285" } } }, { "category": "product_version", "name": "openshift-logging/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b_s390x", "product": { "name": "openshift-logging/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b_s390x", "product_id": "openshift-logging/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b_s390x", "product_identification_helper": { "purl": "pkg:oci/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.4.0-72" } } }, { "category": "product_version", "name": "openshift-logging/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c_s390x", "product": { "name": "openshift-logging/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c_s390x", "product_id": "openshift-logging/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c_s390x", "product_identification_helper": { "purl": "pkg:oci/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.14.6-80" } } }, { "category": "product_version", "name": "openshift-logging/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2_s390x", "product": { "name": "openshift-logging/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2_s390x", "product_id": "openshift-logging/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2_s390x", "product_identification_helper": { "purl": "pkg:oci/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-322" } } }, { "category": "product_version", "name": "openshift-logging/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f_s390x", "product": { "name": "openshift-logging/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f_s390x", "product_id": "openshift-logging/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f_s390x", "product_identification_helper": { "purl": "pkg:oci/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel8\u0026tag=v2.7.3-2" } } }, { "category": "product_version", "name": "openshift-logging/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb_s390x", "product": { "name": "openshift-logging/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb_s390x", "product_id": "openshift-logging/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb_s390x", "product_identification_helper": { "purl": "pkg:oci/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel8\u0026tag=v0.21.0-46" } } }, { "category": "product_version", "name": "openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x", "product": { "name": "openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x", "product_id": "openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x", "product_identification_helper": { "purl": "pkg:oci/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-view-plugin-rhel8\u0026tag=v5.6.1-8" } } }, { "category": "product_version", "name": "openshift-logging/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a_s390x", "product": { "name": "openshift-logging/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a_s390x", "product_id": "openshift-logging/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a_s390x", "product_identification_helper": { "purl": "pkg:oci/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel8-operator\u0026tag=v5.6.1-14" } } }, { "category": "product_version", "name": "openshift-logging/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8_s390x", "product": { "name": "openshift-logging/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8_s390x", "product_id": "openshift-logging/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8_s390x", "product_identification_helper": { "purl": "pkg:oci/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel8\u0026tag=v0.1.0-136" } } }, { "category": "product_version", "name": "openshift-logging/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239_s390x", "product": { "name": "openshift-logging/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239_s390x", "product_id": "openshift-logging/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239_s390x", "product_identification_helper": { "purl": "pkg:oci/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel8\u0026tag=v0.1.0-43" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c_amd64" }, "product_reference": "openshift-logging/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604_arm64" }, "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870_ppc64le" }, "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e_s390x" }, "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a_amd64" }, "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf_amd64" }, "product_reference": "openshift-logging/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1_ppc64le" }, "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead_amd64" }, "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e_arm64" }, "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7_s390x" }, "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0_ppc64le" }, "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a_s390x" }, "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea_arm64" }, "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c_amd64" }, "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598_amd64" }, "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675_s390x" }, "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299_ppc64le" }, "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406_arm64" }, "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593_arm64" }, "product_reference": "openshift-logging/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b_s390x" }, "product_reference": "openshift-logging/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40_ppc64le" }, "product_reference": "openshift-logging/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357_amd64" }, "product_reference": "openshift-logging/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e_amd64" }, "product_reference": "openshift-logging/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c_s390x" }, "product_reference": "openshift-logging/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88_ppc64le" }, "product_reference": "openshift-logging/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb_arm64" }, "product_reference": "openshift-logging/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050_ppc64le" }, "product_reference": "openshift-logging/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268_arm64" }, "product_reference": "openshift-logging/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015_amd64" }, "product_reference": "openshift-logging/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2_s390x" }, "product_reference": "openshift-logging/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f_s390x" }, "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef_arm64" }, "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1_ppc64le" }, "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776_amd64" }, "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3_amd64" }, "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46_s390x" }, "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4_ppc64le" }, "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5_arm64" }, "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f_s390x" }, "product_reference": "openshift-logging/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d_arm64" }, "product_reference": "openshift-logging/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a_amd64" }, "product_reference": "openshift-logging/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd_ppc64le" }, "product_reference": "openshift-logging/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x" }, "product_reference": "openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le" }, "product_reference": "openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64" }, "product_reference": "openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64" }, "product_reference": "openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d_amd64" }, "product_reference": "openshift-logging/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01_amd64" }, "product_reference": "openshift-logging/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b_arm64" }, "product_reference": "openshift-logging/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c_ppc64le" }, "product_reference": "openshift-logging/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a_s390x" }, "product_reference": "openshift-logging/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb_ppc64le" }, "product_reference": "openshift-logging/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8_arm64" }, "product_reference": "openshift-logging/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8_s390x" }, "product_reference": "openshift-logging/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10_amd64" }, "product_reference": "openshift-logging/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239_s390x" }, "product_reference": "openshift-logging/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a_arm64" }, "product_reference": "openshift-logging/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc_amd64" }, "product_reference": "openshift-logging/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729_ppc64le" }, "product_reference": "openshift-logging/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1_arm64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1_arm64" }, "product_reference": "openshift-logging/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1_arm64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb_s390x as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb_s390x" }, "product_reference": "openshift-logging/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb_s390x", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791_amd64 as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791_amd64" }, "product_reference": "openshift-logging/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791_amd64", "relates_to_product_reference": "8Base-RHOL-5.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030_ppc64le as a component of RHOL 5.6 for RHEL 8", "product_id": "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030_ppc64le" }, "product_reference": "openshift-logging/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030_ppc64le", "relates_to_product_reference": "8Base-RHOL-5.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOL-5.6:openshift-logging/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c_amd64", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604_arm64", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870_ppc64le", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e_s390x", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e_arm64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea_arm64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406_arm64", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593_arm64", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b_s390x", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40_ppc64le", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357_amd64", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e_amd64", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c_s390x", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88_ppc64le", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb_arm64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050_ppc64le", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268_arm64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015_amd64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2_s390x", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f_s390x", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef_arm64", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1_ppc64le", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776_amd64", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3_amd64", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46_s390x", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4_ppc64le", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5_arm64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f_s390x", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d_arm64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a_amd64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd_ppc64le", "8Base-RHOL-5.6:openshift-logging/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d_amd64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01_amd64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b_arm64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c_ppc64le", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a_s390x", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb_ppc64le", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8_arm64", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8_s390x", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10_amd64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239_s390x", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a_arm64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc_amd64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729_ppc64le", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1_arm64", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb_s390x", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791_amd64", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64" ], "known_not_affected": [ "8Base-RHOL-5.6:openshift-logging/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c_amd64", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604_arm64", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870_ppc64le", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e_s390x", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e_arm64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea_arm64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406_arm64", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593_arm64", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b_s390x", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40_ppc64le", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357_amd64", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e_amd64", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c_s390x", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88_ppc64le", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb_arm64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050_ppc64le", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268_arm64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015_amd64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2_s390x", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f_s390x", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef_arm64", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1_ppc64le", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776_amd64", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3_amd64", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46_s390x", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4_ppc64le", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5_arm64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f_s390x", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d_arm64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a_amd64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd_ppc64le", "8Base-RHOL-5.6:openshift-logging/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d_amd64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01_amd64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b_arm64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c_ppc64le", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a_s390x", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb_ppc64le", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8_arm64", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8_s390x", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10_amd64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239_s390x", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a_arm64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc_amd64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729_ppc64le", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1_arm64", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb_s390x", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791_amd64", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-09T14:01:04+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0634" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOL-5.6:openshift-logging/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c_amd64", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604_arm64", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870_ppc64le", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e_s390x", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e_arm64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea_arm64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406_arm64", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593_arm64", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b_s390x", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40_ppc64le", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357_amd64", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e_amd64", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c_s390x", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88_ppc64le", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb_arm64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050_ppc64le", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268_arm64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015_amd64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2_s390x", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f_s390x", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef_arm64", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1_ppc64le", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776_amd64", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3_amd64", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46_s390x", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4_ppc64le", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5_arm64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f_s390x", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d_arm64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a_amd64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd_ppc64le", "8Base-RHOL-5.6:openshift-logging/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d_amd64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01_amd64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b_arm64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c_ppc64le", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a_s390x", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb_ppc64le", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8_arm64", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8_s390x", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10_amd64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239_s390x", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a_arm64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc_amd64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729_ppc64le", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1_arm64", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb_s390x", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791_amd64", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64" ], "known_not_affected": [ "8Base-RHOL-5.6:openshift-logging/cluster-logging-operator-bundle@sha256:4c4de06a25a88af6dfda3848e2cdc66e2b81b0d11a8fb81043c1199ad215f43c_amd64", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:03be01e2a187e591d247056d1dc1d2e0564ec5075a735f848106bdc7eb0d9604_arm64", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:465437255399bdcdce43ed7d8d7e190a29a7c2e4dfb1e2a3bf2a07aa595f5870_ppc64le", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:6186588280a47dfedda1867900c1fc7755ce39c3d5ebc2e0af6c0226e3b9f37e_s390x", "8Base-RHOL-5.6:openshift-logging/cluster-logging-rhel8-operator@sha256:8f56f6cfcefce491100202c674fba06fed29d229d09fd403af684a8b0afc218a_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-operator-bundle@sha256:aa657093086192be2ba284a9717fc954adef7586adc0eb14ea359c125fdc31bf_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:7118d1063e36241c329aba318e4e1e9b786ed190dcdcad4bd47bcbbb3ed403d1_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:a9cfe6cfab32fde71adafc7610e002aaa0c46de9d650083d77b52b3a35703ead_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:e3170b6c62d4bb4dc6ca77c57005ba71ddb844767d69dd13b61aa2e333577e8e_arm64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-proxy-rhel8@sha256:f24b8dd673576e03b5e759a3b906e176e1f72704050483d06e2403415e7ca9d7_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:6d1985607bf1731889bc8b9b5687ac4e2df9380c168822738107e949735d73d0_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:858101734cc768f08c2038dd4599a65d06ef542946b382a61345ea996f10767a_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:e8dc7be5875de9517b9e37c8d12e1ee2f392905605b781e17b0fde23f7aa58ea_arm64", "8Base-RHOL-5.6:openshift-logging/elasticsearch-rhel8-operator@sha256:f8203c8cb9811497d830c03be6ffd4fc62ec2f72201de7b33b113a3e37fca08c_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:7883cee3de6e04b2c740b3e24c1eaed17b89248a8415e97ab85e695dc6388598_amd64", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:a31f98d2deaf78d52c68a3f861ba09db418d1eba5db9b29cc78cc7a23cfb2675_s390x", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:acf7b739c2205fed8946d09d1c5ba2c7adeb2347fb18ac373c28618ad7d63299_ppc64le", "8Base-RHOL-5.6:openshift-logging/elasticsearch6-rhel8@sha256:c1c89eb7e7d5908c46db46dbc1e6eb80ed5f51fe994df0b7f6f9c4549975d406_arm64", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:4d45dc2403cdde02b556e5ee0ef8d09403bf602de26dbd291e7d4d173154d593_arm64", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:c22141221795a43d5d7f62400a9e8a29a88426cc48d53ace5cd53b9e5fad179b_s390x", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:c65ce2a082ca42db7aa154a35e1e64b0ea97abad232411e28d64d7be0b8f7b40_ppc64le", "8Base-RHOL-5.6:openshift-logging/eventrouter-rhel8@sha256:efb0d4ccc141ed513e1763aa3d3c290590f099f7ff6bc66a4f0fb05a1e816357_amd64", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:1d2905e0be14c3dfffb432cac00d24dbc1756c8d78e8a1a9e0ef7ebb86fbaf2e_amd64", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:25cb1899ebba4c94accd69793a3013feaa89a088f8e09700063b67034894860c_s390x", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:b009a0de0146e516bf076da58041e223e89ef9ef95fbf38008bce8dcaf717c88_ppc64le", "8Base-RHOL-5.6:openshift-logging/fluentd-rhel8@sha256:cf84cd05812a7cbceb56f44248d1bab0de685c8de5f67a581564f4b88878fcfb_arm64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:20d4683b3d58dc8cecb212e4228f9be17683669f0468d3d5a19f79f9288bf050_ppc64le", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:c94e490f2db36788c4ef8fdfddf1f9015820fe566b521e5675e9c21ffd6dd268_arm64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:e469e40ff731d17a9e6139d7ea07dc6a3be04bbd0663f57aaa0df95ca4bd4015_amd64", "8Base-RHOL-5.6:openshift-logging/kibana6-rhel8@sha256:f417563e42f6c48b87c563d19211bf109d6f04294ad4c9c8d565a8f03e7a98f2_s390x", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:2e0198621752c21e91880c43e0e9422a47a9c0896a203db650627b94d0bdca3f_s390x", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:724138ce2f29e8f8e15a190b7b99f78f65130b6e3136defd419ba1e45cdb2fef_arm64", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:8ea6f2d793049e2c1e36d9680d9a10c5f9b36bbdeb9b04da046f12a8458889e1_ppc64le", "8Base-RHOL-5.6:openshift-logging/log-file-metric-exporter-rhel8@sha256:de74ce01341c7d828f2062761a0a55d26d9404c037660b5375e24d6852a75776_amd64", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:2b76bfa7e3dabcd5e31203b1516b3752754821be5973633809df5f436038fca3_amd64", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:61737b1377c29f3ae8fc1f3c2356d9045e3f223752284352a2b6ac0607e66b46_s390x", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:93ef5a826f9bb3c76cfea86883d2952a2014b03d9b61ce85dab9077c6f9676d4_ppc64le", "8Base-RHOL-5.6:openshift-logging/logging-curator5-rhel8@sha256:e7cc396a0d1dcfdf37c644e07c3d25e808c030c0312a6a746b6518dd9eab08a5_arm64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:257acfca5ea95a2443734651043cc4bc9698fce77ffdb8dd438e6702ea6d1a0f_s390x", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:6431e8d36b8089c41741d0c9d8b2afee23b9fe5a1553df8b0433d6c149eeb74d_arm64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:8e55c1309fcf5b635df75385793d0364ffeeb75d1d7d8a966bf0174f8308f41a_amd64", "8Base-RHOL-5.6:openshift-logging/logging-loki-rhel8@sha256:ac309068afc8029bb3b1a695e986390c39223a2220a693dbc6a249a1976e1cfd_ppc64le", "8Base-RHOL-5.6:openshift-logging/loki-operator-bundle@sha256:fb652cd58431d67de15da6104a87fa1ee984b92312d0e24bfa072086fbde8e5d_amd64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:0ee8cba8efd1665a451a6a700b1502273a07fab98f857031279387c10b688d01_amd64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:19cd6ed87582909f2e4f494acc803267b08d37ccfd7875988d31a1ae92c4909b_arm64", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:af704079c23993c2bc5ddb76e0a3bbe166a6c979a723d0d3deba18c53372402c_ppc64le", "8Base-RHOL-5.6:openshift-logging/loki-rhel8-operator@sha256:b6c4cdcbc4a88b65141f68a8e0339abef9e33781361be292c3ebca520b3c063a_s390x", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:4c9bc0d6da393a273f955ec5a2331802e55c0304c30946fe9f3a196ab65269cb_ppc64le", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:6f51024b22dbc8783fc54f9b60767cce627fad84340397bf2ca52fb154d1c8f8_arm64", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:b8eda223fa4d90bc54d4f387393ff7846119bd63354f0d6e9faae8d0b0b15ca8_s390x", "8Base-RHOL-5.6:openshift-logging/lokistack-gateway-rhel8@sha256:d6a62cc4d0ebaeed68237de8da34150e30bf1b3d360ecd72ec1bd1c5c6486d10_amd64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:232ab968f4939f7033e766368b6b8bcee1c95b23f50d882046770389fc08d239_s390x", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:ae2561c4d894a080f843f4e1c094800d4001bff0f5e85a6add7d9d80b026418a_arm64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:e29725dbfb9ec4987166b65635cc3d9cd51ef70dd4276ebe4440c4d838dc37cc_amd64", "8Base-RHOL-5.6:openshift-logging/opa-openshift-rhel8@sha256:ff883b736157042771802f19c84eb6c420736437dc74022127edcf277d7f0729_ppc64le", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:3e71263bd9c7f0654a1e6d301b6a48be3b08afb162f52466e7343c3dc651b8d1_arm64", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:55bd4ac20eeb722e3f9d3f84f5f66917cfdea1e84e39c7580e5934b9e1317fdb_s390x", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:a8686cd3895df86eaf7bfb57113e3d8c99feeea34fdf8b0e84d536e902f0c791_amd64", "8Base-RHOL-5.6:openshift-logging/vector-rhel8@sha256:babd18762568da07bd303280429f825b736fe423c4122d402da8d2defd5df030_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-09T14:01:04+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0634" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:02eeaf7cdf47c1cf2c84585d1032643980c8ebc385f1940f2e3d361a7160a515_s390x", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:08a93c3c45b229cb3f245ed79da1fe160e68e3db898c388c98a951640835a8f3_ppc64le", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:9a82625e21b7787437cec2524b56886f72abf6a2a656a89c7ce1398e0bdef017_arm64", "8Base-RHOL-5.6:openshift-logging/logging-view-plugin-rhel8@sha256:cb503e4e0dd2313d8ebcc9e204c317af30ab0ec78ae51f0e932497db17a65ca1_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" } ] }
rhsa-2023_1533
Vulnerability from csaf_redhat
Published
2023-03-30 13:06
Modified
2024-11-24 20:44
Summary
Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (14.21.3).
Security Fix(es):
* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* minimist: prototype pollution (CVE-2021-44906)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
* express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.3).\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1533", "url": "https://access.redhat.com/errata/RHSA-2023:1533" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142823", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142823" }, { "category": "external", "summary": "2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "2175828", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2175828" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1533.json" } ], "title": "Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-24T20:44:39+00:00", "generator": { "date": "2024-11-24T20:44:39+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1533", "initial_release_date": "2023-03-30T13:06:07+00:00", "revision_history": [ { "date": "2023-03-30T13:06:07+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-30T13:06:07+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:44:39+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.4::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:14:8040020230306170312:522a0ee4", "product": { "name": "nodejs:14:8040020230306170312:522a0ee4", "product_id": "nodejs:14:8040020230306170312:522a0ee4", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@14:8040020230306170312:522a0ee4" } } }, { "category": "product_version", "name": "nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "product": { "name": "nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "product_id": "nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "product": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "product_id": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, "product_reference": "nodejs:14:8040020230306170312:522a0ee4", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch" }, "product_reference": "nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-4904", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2023-02-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168631" } ], "notes": [ { "category": "description", "text": "A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: buffer overflow in config_sortlist() due to missing string length check", "title": "Vulnerability summary" }, { "category": "other", "text": "The severity of this vulnerability is not important but moderate because exploiting the vulnerability can lead to a disruption of the availability of an application, yet doesn\u2019t compromise data integrity or confidentiality. The opportunity for disruption is further limited due to the requirement that an application allows an attacker to be able to input both untrusted and unvalidated data. Exploiting this flaw requires an application to use the library in such a way that would allow untrusted and unvalidated input to be passed directly to ares_set_sortlist by an attacker. In the event that this is able to occur, the impact to RHEL is limited to a crash of the application due to the protections offered by default in RHEL systems such as Stack Smashing Protection (SSP).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4904" }, { "category": "external", "summary": "RHBZ#2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4904", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4904" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904" }, { "category": "external", "summary": "https://github.com/c-ares/c-ares/issues/496", "url": "https://github.com/c-ares/c-ares/issues/496" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: buffer overflow in config_sortlist() due to missing string length check" }, { "cve": "CVE-2022-24999", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150323" } ], "notes": [ { "category": "description", "text": "A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "express: \"qs\" prototype poisoning causes the hang of the node process", "title": "Vulnerability summary" }, { "category": "other", "text": "- The qs and express Package is not used by the OpenShift Container Platform console directly and is only a third-party package dependency. Hence, it is marked as wontfix. \nAs a result, any services that depend on Openshift for their use of qs and express are marked won\u0027t fix. \n- In OpenShift Service Mesh, \u0027qs\u0027 is hoisted from storybook and node-sass, both are dev dependencies, and the vulnerability is not exposed to end users. Hence marked as wontfix.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24999" }, { "category": "external", "summary": "RHBZ#2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24999", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24999" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999" }, { "category": "external", "summary": "https://github.com/expressjs/express/releases/tag/4.17.3", "url": "https://github.com/expressjs/express/releases/tag/4.17.3" }, { "category": "external", "summary": "https://github.com/ljharb/qs/pull/428", "url": "https://github.com/ljharb/qs/pull/428" }, { "category": "external", "summary": "https://github.com/n8tz/CVE-2022-24999", "url": "https://github.com/n8tz/CVE-2022-24999" } ], "release_date": "2022-11-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "express: \"qs\" prototype poisoning causes the hang of the node process" }, { "cve": "CVE-2022-25881", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2165824" } ], "notes": [ { "category": "description", "text": "A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25881" }, { "category": "external", "summary": "RHBZ#2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability" }, { "acknowledgments": [ { "names": [ "VVX7" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2022-35256", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2022-09-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2130518" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-35256" }, { "category": "external", "summary": "RHBZ#2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-35256", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256", "url": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256" } ], "release_date": "2022-09-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields" }, { "cve": "CVE-2022-38900", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2023-02-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2170644" } ], "notes": [ { "category": "description", "text": "A flaw was found in decode-uri-component. This issue occurs due to a specially crafted input, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "decode-uri-component: improper input validation resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "For OpenShift Container Platform (OCP), Advanced Clusters Management for Kubernetes (ACM) and Advanced Cluster Security (ACS), the NPM decode-uri-component package is only present in source repositories as a development dependency, it is not used in production. Therefore this vulnerability is rated Low for OCP and ACS.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the decode-uri-component package. \nThe vulnerable code is not used, hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38900" }, { "category": "external", "summary": "RHBZ#2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38900", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38900" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900" }, { "category": "external", "summary": "https://github.com/SamVerschueren/decode-uri-component/issues/5", "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq" } ], "release_date": "2022-11-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "decode-uri-component: improper input validation resulting in DoS" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" }, { "cve": "CVE-2023-23918", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2171935" } ], "notes": [ { "category": "description", "text": "A privilege escalation vulnerability exists in Node.js \u003c19.6.1, \u003c18.14.1, \u003c16.19.1 and \u003c14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Permissions policies can be bypassed via process.mainModule", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23918" }, { "category": "external", "summary": "RHBZ#2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Permissions policies can be bypassed via process.mainModule" }, { "cve": "CVE-2023-23920", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172217" } ], "notes": [ { "category": "description", "text": "An untrusted search path vulnerability exists in Node.js. \u003c19.6.1, \u003c18.14.1, \u003c16.19.1, and \u003c14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23920" }, { "category": "external", "summary": "RHBZ#2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: insecure loading of ICU data through ICU_DATA environment variable" } ] }
rhsa-2023_1043
Vulnerability from csaf_redhat
Published
2023-03-01 22:02
Modified
2024-11-25 05:51
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7
Notes
Topic
New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.2 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* keycloak: missing email notification template allowlist (CVE-2022-1274)
* keycloak: minimist: prototype pollution (CVE-2021-44906)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)
* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
* keycloak: path traversal via double URL encoding (CVE-2022-3782)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
* keycloak: reflected XSS attack (CVE-2022-4137)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.2 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n* keycloak: missing email notification template allowlist (CVE-2022-1274)\n* keycloak: minimist: prototype pollution (CVE-2021-44906)\n* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)\n* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)\n* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)\n* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)\n* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)\n* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n* jquery: Passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n* keycloak: reflected XSS attack (CVE-2022-4137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1043", "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1043.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7", "tracking": { "current_release_date": "2024-11-25T05:51:01+00:00", "generator": { "date": "2024-11-25T05:51:01+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1043", "initial_release_date": "2023-03-01T22:02:40+00:00", "revision_history": [ { "date": "2023-03-01T22:02:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-01T22:02:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-25T05:51:01+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product": { "name": "Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el7sso?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el7sso?arch=noarch" } } }, { "category": "product_version", "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_id": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak-server@18.0.6-1.redhat_00001.1.el7sso?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "relates_to_product_reference": "7Server-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "relates_to_product_reference": "7Server-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" }, "product_reference": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "relates_to_product_reference": "7Server-RHSSO-7.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. However, the vulnerability has not been found to be exploitable in reasonable scenarios. \n\nIn RHEL7, pcs-0.9.169-3.el7_9.3 [RHSA-2022:7343] contains an updated version of jquery (3.6.0), which does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "acknowledgments": [ { "names": [ "Marcus Nilsson" ], "organization": "usd AG" } ], "cve": "CVE-2022-1274", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073157" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: HTML injection in execute-actions-email Admin REST API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1274" }, { "category": "external", "summary": "RHBZ#2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1274" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725" } ], "release_date": "2023-02-28T18:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: HTML injection in execute-actions-email Admin REST API" }, { "acknowledgments": [ { "names": [ "Grzegorz Tworek" ], "organization": "SISOFT s.c." } ], "cve": "CVE-2022-1438", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2021-12-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2031904" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS on impersonation under specific circumstances", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1438" }, { "category": "external", "summary": "RHBZ#2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1438", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1438" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438" } ], "release_date": "2023-02-28T18:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS on impersonation under specific circumstances" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-2764", "discovery_date": "2022-08-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2117506" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK from the bytes, causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2764" }, { "category": "external", "summary": "RHBZ#2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2764", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2764" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764" } ], "release_date": "2022-08-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations" }, { "acknowledgments": [ { "names": [ "Peter Flintholm" ], "organization": "Trifork" } ], "cve": "CVE-2022-3916", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2022-11-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2141404" } ], "notes": [ { "category": "description", "text": "A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Session takeover with OIDC offline refreshtokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3916" }, { "category": "external", "summary": "RHBZ#2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3916" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916" } ], "release_date": "2022-11-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: Session takeover with OIDC offline refreshtokens" }, { "cve": "CVE-2022-4137", "cwe": { "id": "CWE-81", "name": "Improper Neutralization of Script in an Error Message Web Page" }, "discovery_date": "2022-11-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2148496" } ], "notes": [ { "category": "description", "text": "A reflected cross-site scripting (XSS) vulnerability was found in the \u0027oob\u0027 OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: reflected XSS attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4137" }, { "category": "external", "summary": "RHBZ#2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4137", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4137" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137" } ], "release_date": "2023-03-01T13:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: reflected XSS attack" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-31129", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-07-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2105075" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service (ReDoS) attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "moment: inefficient parsing algorithm resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse provides the affected software but does not use the functionality and as such its impact has been downgraded to Low.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships a vulnerable version of the moment library. However, this affected functionality is restricted behind OAuth, reducing the impact to Moderate.\n\nRed Hat Satellite ships a vulnerable version of the moment library. However, this only affects a specific component (qpid-dispatch), reducing the impact to Moderate.\n\nRed Hat Ceph Storage (RHCS) ships a vulnerable version of the moment library, however, it is not directly used and is a transitive dependency from Angular. In addition, the impact would only be to the grafana browser, and not the underlying RHCS system, which reduces the impact to Moderate. \n\nRed Hat OpenShift Service Mesh (OSSM) ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nRed Hat OpenShift distributed tracing ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nIn Logging Subsystem for Red Hat OpenShift the vulnerable moment nodejs package is bundled in the ose-logging-kibana6 container as a transitive dependency, hence the direct impact is reduced to Moderate.\n\nIn OpenShift Container Platform 4 the vulnerabile moment package is a third party dependency, hence the direct impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31129" }, { "category": "external", "summary": "RHBZ#2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31129", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g", "url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g" } ], "release_date": "2022-07-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "moment: inefficient parsing algorithm resulting in DoS" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-38749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129706" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38749" }, { "category": "external", "summary": "RHBZ#2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38749", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode" }, { "cve": "CVE-2022-38750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129707" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38750" }, { "category": "external", "summary": "RHBZ#2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38750", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject" }, { "cve": "CVE-2022-38751", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129709" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38751" }, { "category": "external", "summary": "RHBZ#2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "CXF: SSRF Vulnerability" }, { "acknowledgments": [ { "names": [ "Sourav Kumar" ], "organization": "https://github.com/souravs17031999", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0091", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Client Registration endpoint does not check token revocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0091" }, { "category": "external", "summary": "RHBZ#2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0091", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0091" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg" }, { "category": "external", "summary": "https://github.com/keycloak/security/issues/27", "url": "https://github.com/keycloak/security/issues/27" } ], "release_date": "2022-10-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: Client Registration endpoint does not check token revocation" }, { "acknowledgments": [ { "names": [ "Jordi Zayuelas i Mu\u00f1oz" ], "organization": "A1 Digital", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0264", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2023-01-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2160585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: user impersonation via stolen uuid code", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0264" }, { "category": "external", "summary": "RHBZ#2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0264", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0264" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264" } ], "release_date": "2023-02-28T18:58:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: user impersonation via stolen uuid code" } ] }
rhsa-2023_1049
Vulnerability from csaf_redhat
Published
2023-03-01 21:58
Modified
2024-11-25 05:50
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update
Notes
Topic
A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.2 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* keycloak: missing email notification template allowlist (CVE-2022-1274)
* keycloak: minimist: prototype pollution (CVE-2021-44906)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)
* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
* keycloak: path traversal via double URL encoding (CVE-2022-3782)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
* keycloak: reflected XSS attack (CVE-2022-4137)
* Keycloak Node.js Adapter: Open redirect vulnerability in checkSSO (CVE-2022-2237)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.2 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n* keycloak: missing email notification template allowlist (CVE-2022-1274)\n* keycloak: minimist: prototype pollution (CVE-2021-44906)\n* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)\n* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)\n* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)\n* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)\n* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)\n* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n* keycloak: reflected XSS attack (CVE-2022-4137)\n* Keycloak Node.js Adapter: Open redirect vulnerability in checkSSO (CVE-2022-2237)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1049", "url": "https://access.redhat.com/errata/RHSA-2023:1049" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "2097007", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2097007" }, { "category": "external", "summary": "2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1049.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update", "tracking": { "current_release_date": "2024-11-25T05:50:28+00:00", "generator": { "date": "2024-11-25T05:50:28+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1049", "initial_release_date": "2023-03-01T21:58:17+00:00", "revision_history": [ { "date": "2023-03-01T21:58:17+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-01T21:58:17+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-25T05:50:28+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7", "product": { "name": "Red Hat Single Sign-On 7", "product_id": "Red Hat Single Sign-On 7", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. However, the vulnerability has not been found to be exploitable in reasonable scenarios. \n\nIn RHEL7, pcs-0.9.169-3.el7_9.3 [RHSA-2022:7343] contains an updated version of jquery (3.6.0), which does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "acknowledgments": [ { "names": [ "Marcus Nilsson" ], "organization": "usd AG" } ], "cve": "CVE-2022-1274", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073157" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: HTML injection in execute-actions-email Admin REST API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1274" }, { "category": "external", "summary": "RHBZ#2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1274" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725" } ], "release_date": "2023-02-28T18:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: HTML injection in execute-actions-email Admin REST API" }, { "acknowledgments": [ { "names": [ "Grzegorz Tworek" ], "organization": "SISOFT s.c." } ], "cve": "CVE-2022-1438", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2021-12-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2031904" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS on impersonation under specific circumstances", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1438" }, { "category": "external", "summary": "RHBZ#2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1438", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1438" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438" } ], "release_date": "2023-02-28T18:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS on impersonation under specific circumstances" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "acknowledgments": [ { "names": [ "Ayta\u00e7 Kal\u0131nc\u0131", "Ilker Bulgurcu", "Yasin Y\u0131lmaz" ], "organization": "NETA\u015e PENTEST TEAM" } ], "cve": "CVE-2022-2237", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2022-06-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2097007" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.", "title": "Vulnerability description" }, { "category": "summary", "text": "Adapter: Open redirect vulnerability in checkSSO", "title": "Vulnerability summary" }, { "category": "other", "text": "CodeReady Studio is no longer supported. Therefore, this flaw will not be addressed in CodeReady Studio. Please see https://developers.redhat.com/articles/2022/04/18/announcement-red-hat-codeready-studio-reaches-end-life for more information.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2237" }, { "category": "external", "summary": "RHBZ#2097007", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2097007" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2237", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2237" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2237", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2237" } ], "release_date": "2023-03-01T13:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Adapter: Open redirect vulnerability in checkSSO" }, { "cve": "CVE-2022-2764", "discovery_date": "2022-08-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2117506" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK from the bytes, causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2764" }, { "category": "external", "summary": "RHBZ#2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2764", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2764" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764" } ], "release_date": "2022-08-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations" }, { "cve": "CVE-2022-3782", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-10-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2138971" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: path traversal via double URL encoding", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not impacted as this CVE affects the server-side Keycloak execution but Quarkus only acts as a Keycloak client in its quarkus-keycloak-authorization extension. For this reason Quarkus is marked with Low impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3782" }, { "category": "external", "summary": "RHBZ#2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3782", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3782" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3782", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3782" } ], "release_date": "2022-12-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: path traversal via double URL encoding" }, { "acknowledgments": [ { "names": [ "Peter Flintholm" ], "organization": "Trifork" } ], "cve": "CVE-2022-3916", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2022-11-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2141404" } ], "notes": [ { "category": "description", "text": "A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Session takeover with OIDC offline refreshtokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3916" }, { "category": "external", "summary": "RHBZ#2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3916" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916" } ], "release_date": "2022-11-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: Session takeover with OIDC offline refreshtokens" }, { "cve": "CVE-2022-4137", "cwe": { "id": "CWE-81", "name": "Improper Neutralization of Script in an Error Message Web Page" }, "discovery_date": "2022-11-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2148496" } ], "notes": [ { "category": "description", "text": "A reflected cross-site scripting (XSS) vulnerability was found in the \u0027oob\u0027 OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: reflected XSS attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4137" }, { "category": "external", "summary": "RHBZ#2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4137", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4137" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137" } ], "release_date": "2023-03-01T13:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: reflected XSS attack" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "Red Hat Single Sign-On 7" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-31129", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-07-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2105075" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service (ReDoS) attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "moment: inefficient parsing algorithm resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse provides the affected software but does not use the functionality and as such its impact has been downgraded to Low.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships a vulnerable version of the moment library. However, this affected functionality is restricted behind OAuth, reducing the impact to Moderate.\n\nRed Hat Satellite ships a vulnerable version of the moment library. However, this only affects a specific component (qpid-dispatch), reducing the impact to Moderate.\n\nRed Hat Ceph Storage (RHCS) ships a vulnerable version of the moment library, however, it is not directly used and is a transitive dependency from Angular. In addition, the impact would only be to the grafana browser, and not the underlying RHCS system, which reduces the impact to Moderate. \n\nRed Hat OpenShift Service Mesh (OSSM) ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nRed Hat OpenShift distributed tracing ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nIn Logging Subsystem for Red Hat OpenShift the vulnerable moment nodejs package is bundled in the ose-logging-kibana6 container as a transitive dependency, hence the direct impact is reduced to Moderate.\n\nIn OpenShift Container Platform 4 the vulnerabile moment package is a third party dependency, hence the direct impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31129" }, { "category": "external", "summary": "RHBZ#2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31129", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g", "url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g" } ], "release_date": "2022-07-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "moment: inefficient parsing algorithm resulting in DoS" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-38749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129706" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38749" }, { "category": "external", "summary": "RHBZ#2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38749", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode" }, { "cve": "CVE-2022-38750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129707" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38750" }, { "category": "external", "summary": "RHBZ#2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38750", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject" }, { "cve": "CVE-2022-38751", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129709" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38751" }, { "category": "external", "summary": "RHBZ#2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "Red Hat Single Sign-On 7" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "CXF: SSRF Vulnerability" }, { "acknowledgments": [ { "names": [ "Sourav Kumar" ], "organization": "https://github.com/souravs17031999", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0091", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Client Registration endpoint does not check token revocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0091" }, { "category": "external", "summary": "RHBZ#2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0091", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0091" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg" }, { "category": "external", "summary": "https://github.com/keycloak/security/issues/27", "url": "https://github.com/keycloak/security/issues/27" } ], "release_date": "2022-10-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: Client Registration endpoint does not check token revocation" }, { "acknowledgments": [ { "names": [ "Jordi Zayuelas i Mu\u00f1oz" ], "organization": "A1 Digital", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0264", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2023-01-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2160585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: user impersonation via stolen uuid code", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0264" }, { "category": "external", "summary": "RHBZ#2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0264", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0264" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264" } ], "release_date": "2023-02-28T18:58:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:58:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat Single Sign-On 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1049" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: user impersonation via stolen uuid code" } ] }
rhsa-2023_1583
Vulnerability from csaf_redhat
Published
2023-04-04 09:59
Modified
2024-11-22 23:26
Summary
Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (18.14.2).
Security Fix(es):
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.14.2).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1583", "url": "https://access.redhat.com/errata/RHSA-2023:1583" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "2172190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172190" }, { "category": "external", "summary": "2172204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172204" }, { "category": "external", "summary": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "2178087", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178087" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1583.json" } ], "title": "Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T23:26:37+00:00", "generator": { "date": "2024-11-22T23:26:37+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1583", "initial_release_date": "2023-04-04T09:59:44+00:00", "revision_history": [ { "date": "2023-04-04T09:59:44+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-04-04T09:59:44+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T23:26:37+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:18:8070020230322080930:bd1311ed", "product": { "name": "nodejs:18:8070020230322080930:bd1311ed", "product_id": "nodejs:18:8070020230322080930:bd1311ed", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@18:8070020230322080930:bd1311ed" } } }, { "category": "product_version", "name": "nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "product": { "name": "nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "product_id": "nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "product_id": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product": { "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product_id": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel8.7.0%2B15582%2B19c314fa?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product": { "name": "nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product_id": "nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-4.module%2Bel8.7.0%2B15582%2B19c314fa?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "product": { "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "product_id": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "product": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "product_id": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "product": { "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "product_id": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel8.7.0%2B15582%2B19c314fa?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product": { "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product_id": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product_id": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product": { "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product_id": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product": { "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product_id": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product_id": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64", "product": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64", "product_id": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@9.5.0-1.18.14.2.2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product": { "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product_id": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product_id": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product": { "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product_id": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product": { "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product_id": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product_id": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "product": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "product_id": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@9.5.0-1.18.14.2.2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product": { "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_id": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_id": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product": { "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_id": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product": { "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_id": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_id": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "product": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_id": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@9.5.0-1.18.14.2.2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product": { "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product_id": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product_id": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product": { "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product_id": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product": { "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product_id": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product_id": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.14.2-2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "product": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "product_id": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@9.5.0-1.18.14.2.2.module%2Bel8.7.0%2B18445%2B9493b6ea?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, "product_reference": "nodejs:18:8070020230322080930:bd1311ed", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64" }, "product_reference": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le" }, "product_reference": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x" }, "product_reference": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src" }, "product_reference": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64" }, "product_reference": "nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64" }, "product_reference": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le" }, "product_reference": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x" }, "product_reference": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64" }, "product_reference": "nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64" }, "product_reference": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le" }, "product_reference": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x" }, "product_reference": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64" }, "product_reference": "nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64" }, "product_reference": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le" }, "product_reference": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x" }, "product_reference": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64" }, "product_reference": "nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch" }, "product_reference": "nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64" }, "product_reference": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le" }, "product_reference": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x" }, "product_reference": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64" }, "product_reference": "nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch" }, "product_reference": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src" }, "product_reference": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch" }, "product_reference": "nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64" }, "product_reference": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le" }, "product_reference": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x" }, "product_reference": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64 as a component of nodejs:18:8070020230322080930:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" }, "product_reference": "npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:59:44+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1583" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2022-25881", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2165824" } ], "notes": [ { "category": "description", "text": "A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25881" }, { "category": "external", "summary": "RHBZ#2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:59:44+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1583" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability" }, { "cve": "CVE-2023-23918", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2171935" } ], "notes": [ { "category": "description", "text": "A privilege escalation vulnerability exists in Node.js \u003c19.6.1, \u003c18.14.1, \u003c16.19.1 and \u003c14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Permissions policies can be bypassed via process.mainModule", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23918" }, { "category": "external", "summary": "RHBZ#2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:59:44+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1583" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Permissions policies can be bypassed via process.mainModule" }, { "cve": "CVE-2023-23919", "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172170" } ], "notes": [ { "category": "description", "text": "A cryptographic vulnerability exists in Node.js \u003c19.2.0, \u003c18.14.1, \u003c16.19.1, \u003c14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: OpenSSL error handling issues in nodejs crypto library", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23919" }, { "category": "external", "summary": "RHBZ#2172170", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172170" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23919", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23919" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23919", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23919" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:59:44+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1583" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: OpenSSL error handling issues in nodejs crypto library" }, { "cve": "CVE-2023-23920", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172217" } ], "notes": [ { "category": "description", "text": "An untrusted search path vulnerability exists in Node.js. \u003c19.6.1, \u003c18.14.1, \u003c16.19.1, and \u003c14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23920" }, { "category": "external", "summary": "RHBZ#2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:59:44+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1583" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: insecure loading of ICU data through ICU_DATA environment variable" }, { "cve": "CVE-2023-23936", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172190" } ], "notes": [ { "category": "description", "text": "A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the \u0027host\u0027 header. This issue could allow HTTP response splitting and HTTP header injection.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Fetch API did not protect against CRLF injection in host headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23936" }, { "category": "external", "summary": "RHBZ#2172190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172190" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23936", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23936" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23936", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23936" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:59:44+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1583" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Fetch API did not protect against CRLF injection in host headers" }, { "cve": "CVE-2023-24807", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172204" } ], "notes": [ { "category": "description", "text": "Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Regular Expression Denial of Service in Headers fetch API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-24807" }, { "category": "external", "summary": "RHBZ#2172204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172204" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-24807", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24807" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24807", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24807" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:59:44+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1583" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debuginfo-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-debugsource-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-devel-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-docs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-full-i18n-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+18445+9493b6ea.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020230322080930:bd1311ed:npm-1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: Regular Expression Denial of Service in Headers fetch API" } ] }
rhsa-2023_0612
Vulnerability from csaf_redhat
Published
2023-02-06 19:42
Modified
2024-11-24 20:41
Summary
Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
Notes
Topic
An update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: rh-nodejs14-nodejs (14.21.1), rh-nodejs14-nodejs-nodemon (2.0.20). (BZ#2129806, BZ#2135519, BZ#2135520, BZ#2141022)
Security Fix(es):
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* minimist: prototype pollution (CVE-2021-44906)
* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* rh-nodejs14-nodejs: Provide full-i18n subpackage (BZ#2009880)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: rh-nodejs14-nodejs (14.21.1), rh-nodejs14-nodejs-nodemon (2.0.20). (BZ#2129806, BZ#2135519, BZ#2135520, BZ#2141022)\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* rh-nodejs14-nodejs: Provide full-i18n subpackage (BZ#2009880)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0612", "url": "https://access.redhat.com/errata/RHSA-2023:0612" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2009880", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2009880" }, { "category": "external", "summary": "2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2129806", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129806" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0612.json" } ], "title": "Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update", "tracking": { "current_release_date": "2024-11-24T20:41:46+00:00", "generator": { "date": "2024-11-24T20:41:46+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:0612", "initial_release_date": "2023-02-06T19:42:24+00:00", "revision_history": [ { "date": "2023-02-06T19:42:24+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-02-06T19:42:24+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:41:46+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for RHEL(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "product": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "product_id": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-nodemon@2.0.20-2.el7?arch=src" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "product": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "product_id": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.21.1-3.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "product": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "product_id": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-nodemon@2.0.20-2.el7?arch=noarch" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "product": { "name": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "product_id": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-docs@14.21.1-3.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "product_id": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.21.1-3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "product_id": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.21.1-3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "product_id": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-full-i18n@14.21.1-3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "product": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "product_id": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.17-14.21.1.3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.21.1-3.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "product_id": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.21.1-3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "product_id": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.21.1-3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "product_id": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-full-i18n@14.21.1-3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "product": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "product_id": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.17-14.21.1.3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.21.1-3.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.21.1-3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.21.1-3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-full-i18n@14.21.1-3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "product": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "product_id": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.17-14.21.1.3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.21.1-3.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-0235", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2022-01-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2044591" } ], "notes": [ { "category": "description", "text": "A flaw was found in node-fetch. When following a redirect to a third-party domain, node-fetch was forwarding sensitive headers such as \"Authorization,\" \"WWW-Authenticate,\" and \"Cookie\" to potentially untrusted targets. This flaw leads to the exposure of sensitive information to an unauthorized actor.", "title": "Vulnerability description" }, { "category": "summary", "text": "node-fetch: exposure of sensitive information to an unauthorized actor", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw is out of support scope for dotnet-5.0. For more information about Dotnet product support scope, please see https://access.redhat.com/support/policy/updates/net-core", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-0235" }, { "category": "external", "summary": "RHBZ#2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-0235", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0235" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235" }, { "category": "external", "summary": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/", "url": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/" } ], "release_date": "2022-01-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "node-fetch: exposure of sensitive information to an unauthorized actor" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-24999", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150323" } ], "notes": [ { "category": "description", "text": "A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "express: \"qs\" prototype poisoning causes the hang of the node process", "title": "Vulnerability summary" }, { "category": "other", "text": "- The qs and express Package is not used by the OpenShift Container Platform console directly and is only a third-party package dependency. Hence, it is marked as wontfix. \nAs a result, any services that depend on Openshift for their use of qs and express are marked won\u0027t fix. \n- In OpenShift Service Mesh, \u0027qs\u0027 is hoisted from storybook and node-sass, both are dev dependencies, and the vulnerability is not exposed to end users. Hence marked as wontfix.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24999" }, { "category": "external", "summary": "RHBZ#2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24999", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24999" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999" }, { "category": "external", "summary": "https://github.com/expressjs/express/releases/tag/4.17.3", "url": "https://github.com/expressjs/express/releases/tag/4.17.3" }, { "category": "external", "summary": "https://github.com/ljharb/qs/pull/428", "url": "https://github.com/ljharb/qs/pull/428" }, { "category": "external", "summary": "https://github.com/n8tz/CVE-2022-24999", "url": "https://github.com/n8tz/CVE-2022-24999" } ], "release_date": "2022-11-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "express: \"qs\" prototype poisoning causes the hang of the node process" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" } ] }
rhsa-2023_2655
Vulnerability from csaf_redhat
Published
2023-05-09 11:51
Modified
2024-11-22 23:26
Summary
Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update
Notes
Topic
An update for nodejs and nodejs-nodemon is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).
Security Fix(es):
* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for nodejs and nodejs-nodemon is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:2655", "url": "https://access.redhat.com/errata/RHSA-2023:2655" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "2172190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172190" }, { "category": "external", "summary": "2172204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172204" }, { "category": "external", "summary": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "2178076", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178076" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2655.json" } ], "title": "Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T23:26:41+00:00", "generator": { "date": "2024-11-22T23:26:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:2655", "initial_release_date": "2023-05-09T11:51:16+00:00", "revision_history": [ { "date": "2023-05-09T11:51:16+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-05-09T11:51:16+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T23:26:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.el9_2.src", "product": { "name": "nodejs-nodemon-0:2.0.20-3.el9_2.src", "product_id": "nodejs-nodemon-0:2.0.20-3.el9_2.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.el9_2?arch=src" } } }, { "category": "product_version", "name": "nodejs-1:16.19.1-1.el9_2.src", "product": { "name": "nodejs-1:16.19.1-1.el9_2.src", "product_id": "nodejs-1:16.19.1-1.el9_2.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.19.1-1.el9_2?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "product_id": "nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.el9_2?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-docs-1:16.19.1-1.el9_2.noarch", "product": { "name": "nodejs-docs-1:16.19.1-1.el9_2.noarch", "product_id": "nodejs-docs-1:16.19.1-1.el9_2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@16.19.1-1.el9_2?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.19.1-1.el9_2.aarch64", "product": { "name": "nodejs-1:16.19.1-1.el9_2.aarch64", "product_id": "nodejs-1:16.19.1-1.el9_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.19.1-1.el9_2?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "product": { "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "product_id": "nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.19.1-1.el9_2?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.19.1-1.el9_2.aarch64", "product": { "name": "nodejs-libs-1:16.19.1-1.el9_2.aarch64", "product_id": "nodejs-libs-1:16.19.1-1.el9_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs@16.19.1-1.el9_2?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "product": { "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "product_id": "npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.3-1.16.19.1.1.el9_2?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "product": { "name": "nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "product_id": "nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.19.1-1.el9_2?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "product": { "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "product_id": "nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.19.1-1.el9_2?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "product": { "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "product_id": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@16.19.1-1.el9_2?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.19.1-1.el9_2.ppc64le", "product": { "name": "nodejs-1:16.19.1-1.el9_2.ppc64le", "product_id": "nodejs-1:16.19.1-1.el9_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.19.1-1.el9_2?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "product": { "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "product_id": "nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.19.1-1.el9_2?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "product": { "name": "nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "product_id": "nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs@16.19.1-1.el9_2?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "product": { "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "product_id": "npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.3-1.16.19.1.1.el9_2?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "product": { "name": "nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "product_id": "nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.19.1-1.el9_2?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "product": { "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "product_id": "nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.19.1-1.el9_2?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "product": { "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "product_id": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@16.19.1-1.el9_2?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.19.1-1.el9_2.x86_64", "product": { "name": "nodejs-1:16.19.1-1.el9_2.x86_64", "product_id": "nodejs-1:16.19.1-1.el9_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.19.1-1.el9_2?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "product": { "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "product_id": "nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.19.1-1.el9_2?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.19.1-1.el9_2.x86_64", "product": { "name": "nodejs-libs-1:16.19.1-1.el9_2.x86_64", "product_id": "nodejs-libs-1:16.19.1-1.el9_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs@16.19.1-1.el9_2?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64", "product": { "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64", "product_id": "npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.3-1.16.19.1.1.el9_2?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "product": { "name": "nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "product_id": "nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.19.1-1.el9_2?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "product": { "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "product_id": "nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.19.1-1.el9_2?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "product": { "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "product_id": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@16.19.1-1.el9_2?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nodejs-libs-1:16.19.1-1.el9_2.i686", "product": { "name": "nodejs-libs-1:16.19.1-1.el9_2.i686", "product_id": "nodejs-libs-1:16.19.1-1.el9_2.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs@16.19.1-1.el9_2?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.19.1-1.el9_2.i686", "product": { "name": "nodejs-debugsource-1:16.19.1-1.el9_2.i686", "product_id": "nodejs-debugsource-1:16.19.1-1.el9_2.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.19.1-1.el9_2?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "product": { "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "product_id": "nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.19.1-1.el9_2?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "product": { "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "product_id": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@16.19.1-1.el9_2?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.19.1-1.el9_2.s390x", "product": { "name": "nodejs-1:16.19.1-1.el9_2.s390x", "product_id": "nodejs-1:16.19.1-1.el9_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.19.1-1.el9_2?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "product": { "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "product_id": "nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.19.1-1.el9_2?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.19.1-1.el9_2.s390x", "product": { "name": "nodejs-libs-1:16.19.1-1.el9_2.s390x", "product_id": "nodejs-libs-1:16.19.1-1.el9_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs@16.19.1-1.el9_2?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "product": { "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "product_id": "npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.3-1.16.19.1.1.el9_2?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "product": { "name": "nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "product_id": "nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.19.1-1.el9_2?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "product": { "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "product_id": "nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.19.1-1.el9_2?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "product": { "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "product_id": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@16.19.1-1.el9_2?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.19.1-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64" }, "product_reference": "nodejs-1:16.19.1-1.el9_2.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.19.1-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le" }, "product_reference": "nodejs-1:16.19.1-1.el9_2.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.19.1-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x" }, "product_reference": "nodejs-1:16.19.1-1.el9_2.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.19.1-1.el9_2.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src" }, "product_reference": "nodejs-1:16.19.1-1.el9_2.src", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.19.1-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64" }, "product_reference": "nodejs-1:16.19.1-1.el9_2.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64" }, "product_reference": "nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686" }, "product_reference": "nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le" }, "product_reference": "nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x" }, "product_reference": "nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64" }, "product_reference": "nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.19.1-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64" }, "product_reference": "nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.19.1-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686" }, "product_reference": "nodejs-debugsource-1:16.19.1-1.el9_2.i686", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le" }, "product_reference": "nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.19.1-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x" }, "product_reference": "nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.19.1-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64" }, "product_reference": "nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:16.19.1-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch" }, "product_reference": "nodejs-docs-1:16.19.1-1.el9_2.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64" }, "product_reference": "nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le" }, "product_reference": "nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x" }, "product_reference": "nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64" }, "product_reference": "nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.19.1-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64" }, "product_reference": "nodejs-libs-1:16.19.1-1.el9_2.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.19.1-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686" }, "product_reference": "nodejs-libs-1:16.19.1-1.el9_2.i686", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.19.1-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le" }, "product_reference": "nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.19.1-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x" }, "product_reference": "nodejs-libs-1:16.19.1-1.el9_2.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.19.1-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64" }, "product_reference": "nodejs-libs-1:16.19.1-1.el9_2.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64" }, "product_reference": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686" }, "product_reference": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le" }, "product_reference": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x" }, "product_reference": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64" }, "product_reference": "nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.el9_2.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.el9_2.src", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64" }, "product_reference": "npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le" }, "product_reference": "npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x" }, "product_reference": "npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" }, "product_reference": "npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2655" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2022-4904", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2023-02-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168631" } ], "notes": [ { "category": "description", "text": "A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: buffer overflow in config_sortlist() due to missing string length check", "title": "Vulnerability summary" }, { "category": "other", "text": "The severity of this vulnerability is not important but moderate because exploiting the vulnerability can lead to a disruption of the availability of an application, yet doesn\u2019t compromise data integrity or confidentiality. The opportunity for disruption is further limited due to the requirement that an application allows an attacker to be able to input both untrusted and unvalidated data. Exploiting this flaw requires an application to use the library in such a way that would allow untrusted and unvalidated input to be passed directly to ares_set_sortlist by an attacker. In the event that this is able to occur, the impact to RHEL is limited to a crash of the application due to the protections offered by default in RHEL systems such as Stack Smashing Protection (SSP).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "known_not_affected": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4904" }, { "category": "external", "summary": "RHBZ#2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4904", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4904" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904" }, { "category": "external", "summary": "https://github.com/c-ares/c-ares/issues/496", "url": "https://github.com/c-ares/c-ares/issues/496" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2655" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: buffer overflow in config_sortlist() due to missing string length check" }, { "cve": "CVE-2022-25881", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-01-31T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2165824" } ], "notes": [ { "category": "description", "text": "A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "known_not_affected": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25881" }, { "category": "external", "summary": "RHBZ#2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2655" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability" }, { "cve": "CVE-2023-23918", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-02-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2171935" } ], "notes": [ { "category": "description", "text": "A privilege escalation vulnerability exists in Node.js \u003c19.6.1, \u003c18.14.1, \u003c16.19.1 and \u003c14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Permissions policies can be bypassed via process.mainModule", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "known_not_affected": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23918" }, { "category": "external", "summary": "RHBZ#2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2655" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Permissions policies can be bypassed via process.mainModule" }, { "cve": "CVE-2023-23920", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "discovery_date": "2023-02-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172217" } ], "notes": [ { "category": "description", "text": "An untrusted search path vulnerability exists in Node.js. \u003c19.6.1, \u003c18.14.1, \u003c16.19.1, and \u003c14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "known_not_affected": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23920" }, { "category": "external", "summary": "RHBZ#2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2655" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: insecure loading of ICU data through ICU_DATA environment variable" }, { "cve": "CVE-2023-23936", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)" }, "discovery_date": "2023-02-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172190" } ], "notes": [ { "category": "description", "text": "A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the \u0027host\u0027 header. This issue could allow HTTP response splitting and HTTP header injection.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Fetch API did not protect against CRLF injection in host headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "known_not_affected": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23936" }, { "category": "external", "summary": "RHBZ#2172190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172190" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23936", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23936" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23936", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23936" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2655" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Fetch API did not protect against CRLF injection in host headers" }, { "cve": "CVE-2023-24807", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-02-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172204" } ], "notes": [ { "category": "description", "text": "Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Regular Expression Denial of Service in Headers fetch API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "known_not_affected": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-nodemon-0:2.0.20-3.el9_2.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-24807" }, { "category": "external", "summary": "RHBZ#2172204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172204" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-24807", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24807" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24807", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24807" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2655" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-debugsource-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-docs-1:16.19.1-1.el9_2.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-full-i18n-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.i686", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:16.19.1-1.el9_2.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.s390x", "AppStream-9.2.0.Z.MAIN.EUS:npm-1:8.19.3-1.16.19.1.1.el9_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: Regular Expression Denial of Service in Headers fetch API" } ] }
rhsa-2023_2654
Vulnerability from csaf_redhat
Published
2023-05-09 11:51
Modified
2024-11-22 23:26
Summary
Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (18.14.2).
Security Fix(es):
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.14.2).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:2654", "url": "https://access.redhat.com/errata/RHSA-2023:2654" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "2172170", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172170" }, { "category": "external", "summary": "2172190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172190" }, { "category": "external", "summary": "2172204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172204" }, { "category": "external", "summary": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "2178088", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178088" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2654.json" } ], "title": "Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T23:26:50+00:00", "generator": { "date": "2024-11-22T23:26:50+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:2654", "initial_release_date": "2023-05-09T11:51:08+00:00", "revision_history": [ { "date": "2023-05-09T11:51:08+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-05-09T11:51:08+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T23:26:50+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:18:9020020230327152102:rhel9", "product": { "name": "nodejs:18:9020020230327152102:rhel9", "product_id": "nodejs:18:9020020230327152102:rhel9", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@18:9020020230327152102:rhel9" } } }, { "category": "product_version", "name": "nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "product": { "name": "nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "product_id": "nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "product_id": "nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product": { "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product_id": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel9.1.0%2B15718%2Be52ec601?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product": { "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product_id": "nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-4.module%2Bel9.1.0%2B15718%2Be52ec601?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product": { "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product_id": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product_id": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product": { "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product_id": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product": { "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product_id": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product_id": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "product": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "product_id": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@9.5.0-1.18.14.2.2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "product": { "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "product_id": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "product": { "name": "nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "product_id": "nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "product": { "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "product_id": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel9.1.0%2B15718%2Be52ec601?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product": { "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_id": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_id": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product": { "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_id": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product": { "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_id": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_id": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "product": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_id": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@9.5.0-1.18.14.2.2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product": { "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product_id": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product_id": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product": { "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product_id": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product": { "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product_id": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product_id": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "product": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "product_id": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@9.5.0-1.18.14.2.2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product": { "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product_id": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product_id": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product": { "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product_id": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product": { "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product_id": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product_id": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.14.2-2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64", "product": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64", "product_id": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@9.5.0-1.18.14.2.2.module%2Bel9.2.0.z%2B18497%2Ba402347c?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, "product_reference": "nodejs:18:9020020230327152102:rhel9", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64" }, "product_reference": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le" }, "product_reference": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x" }, "product_reference": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src" }, "product_reference": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64" }, "product_reference": "nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64" }, "product_reference": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le" }, "product_reference": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x" }, "product_reference": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64" }, "product_reference": "nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64" }, "product_reference": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le" }, "product_reference": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x" }, "product_reference": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64" }, "product_reference": "nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64" }, "product_reference": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le" }, "product_reference": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x" }, "product_reference": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64" }, "product_reference": "nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch" }, "product_reference": "nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64" }, "product_reference": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le" }, "product_reference": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x" }, "product_reference": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64" }, "product_reference": "nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch" }, "product_reference": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src" }, "product_reference": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch" }, "product_reference": "nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64" }, "product_reference": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le" }, "product_reference": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x" }, "product_reference": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64 as a component of nodejs:18:9020020230327152102:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" }, "product_reference": "npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64", "relates_to_product_reference": "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:08+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2654" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2022-4904", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2023-02-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168631" } ], "notes": [ { "category": "description", "text": "A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: buffer overflow in config_sortlist() due to missing string length check", "title": "Vulnerability summary" }, { "category": "other", "text": "The severity of this vulnerability is not important but moderate because exploiting the vulnerability can lead to a disruption of the availability of an application, yet doesn\u2019t compromise data integrity or confidentiality. The opportunity for disruption is further limited due to the requirement that an application allows an attacker to be able to input both untrusted and unvalidated data. Exploiting this flaw requires an application to use the library in such a way that would allow untrusted and unvalidated input to be passed directly to ares_set_sortlist by an attacker. In the event that this is able to occur, the impact to RHEL is limited to a crash of the application due to the protections offered by default in RHEL systems such as Stack Smashing Protection (SSP).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4904" }, { "category": "external", "summary": "RHBZ#2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4904", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4904" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904" }, { "category": "external", "summary": "https://github.com/c-ares/c-ares/issues/496", "url": "https://github.com/c-ares/c-ares/issues/496" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:08+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2654" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: buffer overflow in config_sortlist() due to missing string length check" }, { "cve": "CVE-2022-25881", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2165824" } ], "notes": [ { "category": "description", "text": "A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25881" }, { "category": "external", "summary": "RHBZ#2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:08+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2654" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability" }, { "cve": "CVE-2023-23918", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2171935" } ], "notes": [ { "category": "description", "text": "A privilege escalation vulnerability exists in Node.js \u003c19.6.1, \u003c18.14.1, \u003c16.19.1 and \u003c14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Permissions policies can be bypassed via process.mainModule", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23918" }, { "category": "external", "summary": "RHBZ#2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:08+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2654" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Permissions policies can be bypassed via process.mainModule" }, { "cve": "CVE-2023-23919", "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172170" } ], "notes": [ { "category": "description", "text": "A cryptographic vulnerability exists in Node.js \u003c19.2.0, \u003c18.14.1, \u003c16.19.1, \u003c14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: OpenSSL error handling issues in nodejs crypto library", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23919" }, { "category": "external", "summary": "RHBZ#2172170", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172170" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23919", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23919" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23919", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23919" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:08+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2654" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: OpenSSL error handling issues in nodejs crypto library" }, { "cve": "CVE-2023-23920", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172217" } ], "notes": [ { "category": "description", "text": "An untrusted search path vulnerability exists in Node.js. \u003c19.6.1, \u003c18.14.1, \u003c16.19.1, and \u003c14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23920" }, { "category": "external", "summary": "RHBZ#2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:08+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2654" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: insecure loading of ICU data through ICU_DATA environment variable" }, { "cve": "CVE-2023-23936", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172190" } ], "notes": [ { "category": "description", "text": "A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the \u0027host\u0027 header. This issue could allow HTTP response splitting and HTTP header injection.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Fetch API did not protect against CRLF injection in host headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23936" }, { "category": "external", "summary": "RHBZ#2172190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172190" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23936", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23936" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23936", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23936" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:08+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2654" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Fetch API did not protect against CRLF injection in host headers" }, { "cve": "CVE-2023-24807", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172204" } ], "notes": [ { "category": "description", "text": "Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Regular Expression Denial of Service in Headers fetch API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-24807" }, { "category": "external", "summary": "RHBZ#2172204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172204" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-24807", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24807" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24807", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24807" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-05-09T11:51:08+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:2654" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debuginfo-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-debugsource-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-docs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-full-i18n-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-nodemon-0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x", "AppStream-9.2.0.Z.MAIN.EUS:nodejs:18:9020020230327152102:rhel9:npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: Regular Expression Denial of Service in Headers fetch API" } ] }
rhsa-2023_1742
Vulnerability from csaf_redhat
Published
2023-04-12 15:04
Modified
2024-11-24 20:44
Summary
Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (14.21.3).
Security Fix(es):
* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
* minimist: prototype pollution (CVE-2021-44906)
* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
* express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)
* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.3).\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1742", "url": "https://access.redhat.com/errata/RHSA-2023:1742" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142822", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142822" }, { "category": "external", "summary": "2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "2175827", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2175827" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1742.json" } ], "title": "Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-24T20:44:11+00:00", "generator": { "date": "2024-11-24T20:44:11+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1742", "initial_release_date": "2023-04-12T15:04:47+00:00", "revision_history": [ { "date": "2023-04-12T15:04:47+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-04-12T15:04:47+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:44:11+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.6::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:14:8060020230306170237:ad008a3a", "product": { "name": "nodejs:14:8060020230306170237:ad008a3a", "product_id": "nodejs:14:8060020230306170237:ad008a3a", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@14:8060020230306170237:ad008a3a" } } }, { "category": "product_version", "name": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "product": { "name": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "product_id": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, "product_reference": "nodejs:14:8060020230306170237:ad008a3a", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch" }, "product_reference": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-0235", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2022-01-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2044591" } ], "notes": [ { "category": "description", "text": "A flaw was found in node-fetch. When following a redirect to a third-party domain, node-fetch was forwarding sensitive headers such as \"Authorization,\" \"WWW-Authenticate,\" and \"Cookie\" to potentially untrusted targets. This flaw leads to the exposure of sensitive information to an unauthorized actor.", "title": "Vulnerability description" }, { "category": "summary", "text": "node-fetch: exposure of sensitive information to an unauthorized actor", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw is out of support scope for dotnet-5.0. For more information about Dotnet product support scope, please see https://access.redhat.com/support/policy/updates/net-core", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-0235" }, { "category": "external", "summary": "RHBZ#2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-0235", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0235" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235" }, { "category": "external", "summary": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/", "url": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/" } ], "release_date": "2022-01-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "node-fetch: exposure of sensitive information to an unauthorized actor" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-4904", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2023-02-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168631" } ], "notes": [ { "category": "description", "text": "A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: buffer overflow in config_sortlist() due to missing string length check", "title": "Vulnerability summary" }, { "category": "other", "text": "The severity of this vulnerability is not important but moderate because exploiting the vulnerability can lead to a disruption of the availability of an application, yet doesn\u2019t compromise data integrity or confidentiality. The opportunity for disruption is further limited due to the requirement that an application allows an attacker to be able to input both untrusted and unvalidated data. Exploiting this flaw requires an application to use the library in such a way that would allow untrusted and unvalidated input to be passed directly to ares_set_sortlist by an attacker. In the event that this is able to occur, the impact to RHEL is limited to a crash of the application due to the protections offered by default in RHEL systems such as Stack Smashing Protection (SSP).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4904" }, { "category": "external", "summary": "RHBZ#2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4904", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4904" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904" }, { "category": "external", "summary": "https://github.com/c-ares/c-ares/issues/496", "url": "https://github.com/c-ares/c-ares/issues/496" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: buffer overflow in config_sortlist() due to missing string length check" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" }, { "cve": "CVE-2022-24999", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150323" } ], "notes": [ { "category": "description", "text": "A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "express: \"qs\" prototype poisoning causes the hang of the node process", "title": "Vulnerability summary" }, { "category": "other", "text": "- The qs and express Package is not used by the OpenShift Container Platform console directly and is only a third-party package dependency. Hence, it is marked as wontfix. \nAs a result, any services that depend on Openshift for their use of qs and express are marked won\u0027t fix. \n- In OpenShift Service Mesh, \u0027qs\u0027 is hoisted from storybook and node-sass, both are dev dependencies, and the vulnerability is not exposed to end users. Hence marked as wontfix.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24999" }, { "category": "external", "summary": "RHBZ#2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24999", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24999" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999" }, { "category": "external", "summary": "https://github.com/expressjs/express/releases/tag/4.17.3", "url": "https://github.com/expressjs/express/releases/tag/4.17.3" }, { "category": "external", "summary": "https://github.com/ljharb/qs/pull/428", "url": "https://github.com/ljharb/qs/pull/428" }, { "category": "external", "summary": "https://github.com/n8tz/CVE-2022-24999", "url": "https://github.com/n8tz/CVE-2022-24999" } ], "release_date": "2022-11-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "express: \"qs\" prototype poisoning causes the hang of the node process" }, { "cve": "CVE-2022-25881", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2165824" } ], "notes": [ { "category": "description", "text": "A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25881" }, { "category": "external", "summary": "RHBZ#2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability" }, { "acknowledgments": [ { "names": [ "VVX7" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2022-35256", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2022-09-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2130518" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-35256" }, { "category": "external", "summary": "RHBZ#2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-35256", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256", "url": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256" } ], "release_date": "2022-09-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields" }, { "cve": "CVE-2022-38900", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2023-02-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2170644" } ], "notes": [ { "category": "description", "text": "A flaw was found in decode-uri-component. This issue occurs due to a specially crafted input, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "decode-uri-component: improper input validation resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "For OpenShift Container Platform (OCP), Advanced Clusters Management for Kubernetes (ACM) and Advanced Cluster Security (ACS), the NPM decode-uri-component package is only present in source repositories as a development dependency, it is not used in production. Therefore this vulnerability is rated Low for OCP and ACS.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the decode-uri-component package. \nThe vulnerable code is not used, hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38900" }, { "category": "external", "summary": "RHBZ#2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38900", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38900" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900" }, { "category": "external", "summary": "https://github.com/SamVerschueren/decode-uri-component/issues/5", "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq" } ], "release_date": "2022-11-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "decode-uri-component: improper input validation resulting in DoS" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" }, { "cve": "CVE-2023-23918", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2171935" } ], "notes": [ { "category": "description", "text": "A privilege escalation vulnerability exists in Node.js \u003c19.6.1, \u003c18.14.1, \u003c16.19.1 and \u003c14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Permissions policies can be bypassed via process.mainModule", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23918" }, { "category": "external", "summary": "RHBZ#2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Permissions policies can be bypassed via process.mainModule" }, { "cve": "CVE-2023-23920", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172217" } ], "notes": [ { "category": "description", "text": "An untrusted search path vulnerability exists in Node.js. \u003c19.6.1, \u003c18.14.1, \u003c16.19.1, and \u003c14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23920" }, { "category": "external", "summary": "RHBZ#2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: insecure loading of ICU data through ICU_DATA environment variable" } ] }
rhsa-2023_1582
Vulnerability from csaf_redhat
Published
2023-04-04 09:57
Modified
2024-11-22 23:26
Summary
Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (16.19.1).
Security Fix(es):
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.19.1).\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)\n\n* Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\n* Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1582", "url": "https://access.redhat.com/errata/RHSA-2023:1582" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "2172170", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172170" }, { "category": "external", "summary": "2172190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172190" }, { "category": "external", "summary": "2172204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172204" }, { "category": "external", "summary": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "2178142", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178142" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1582.json" } ], "title": "Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T23:26:27+00:00", "generator": { "date": "2024-11-22T23:26:27+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1582", "initial_release_date": "2023-04-04T09:57:16+00:00", "revision_history": [ { "date": "2023-04-04T09:57:16+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-04-04T09:57:16+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T23:26:27+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:16:8070020230314140722:bd1311ed", "product": { "name": "nodejs:16:8070020230314140722:bd1311ed", "product_id": "nodejs:16:8070020230314140722:bd1311ed", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@16:8070020230314140722:bd1311ed" } } }, { "category": "product_version", "name": "nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "product": { "name": "nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "product_id": "nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.7.0%2B18373%2B704f5cef?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product_id": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@25-1.module%2Bel8.5.0%2B10992%2Bfac5fe06?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "product": { "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "product_id": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.7.0%2B18373%2B704f5cef?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product_id": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@25-1.module%2Bel8.5.0%2B10992%2Bfac5fe06?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product": { "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product_id": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product": { "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product_id": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product": { "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product_id": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product": { "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product_id": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product": { "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product_id": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64", "product": { "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64", "product_id": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.3-1.16.19.1.1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product": { "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product_id": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product": { "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product_id": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product": { "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product_id": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product": { "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product_id": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product": { "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product_id": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "product": { "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "product_id": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.3-1.16.19.1.1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product": { "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product_id": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product": { "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product_id": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product": { "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product_id": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product": { "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product_id": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product": { "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product_id": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "product": { "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "product_id": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.3-1.16.19.1.1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product": { "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product_id": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product": { "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product_id": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product": { "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product_id": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product": { "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product_id": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product": { "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product_id": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.19.1-1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "product": { "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "product_id": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.3-1.16.19.1.1.module%2Bel8.7.0%2B18373%2B704f5cef?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, "product_reference": "nodejs:16:8070020230314140722:bd1311ed", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64" }, "product_reference": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le" }, "product_reference": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x" }, "product_reference": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src" }, "product_reference": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64" }, "product_reference": "nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64" }, "product_reference": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le" }, "product_reference": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x" }, "product_reference": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64" }, "product_reference": "nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64" }, "product_reference": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le" }, "product_reference": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x" }, "product_reference": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64" }, "product_reference": "nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64" }, "product_reference": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le" }, "product_reference": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x" }, "product_reference": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64" }, "product_reference": "nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch" }, "product_reference": "nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64" }, "product_reference": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le" }, "product_reference": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x" }, "product_reference": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64" }, "product_reference": "nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch" }, "product_reference": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src" }, "product_reference": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64" }, "product_reference": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le" }, "product_reference": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x" }, "product_reference": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64 as a component of nodejs:16:8070020230314140722:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" }, "product_reference": "npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:57:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1582" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2022-4904", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2023-02-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168631" } ], "notes": [ { "category": "description", "text": "A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: buffer overflow in config_sortlist() due to missing string length check", "title": "Vulnerability summary" }, { "category": "other", "text": "The severity of this vulnerability is not important but moderate because exploiting the vulnerability can lead to a disruption of the availability of an application, yet doesn\u2019t compromise data integrity or confidentiality. The opportunity for disruption is further limited due to the requirement that an application allows an attacker to be able to input both untrusted and unvalidated data. Exploiting this flaw requires an application to use the library in such a way that would allow untrusted and unvalidated input to be passed directly to ares_set_sortlist by an attacker. In the event that this is able to occur, the impact to RHEL is limited to a crash of the application due to the protections offered by default in RHEL systems such as Stack Smashing Protection (SSP).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4904" }, { "category": "external", "summary": "RHBZ#2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4904", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4904" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904" }, { "category": "external", "summary": "https://github.com/c-ares/c-ares/issues/496", "url": "https://github.com/c-ares/c-ares/issues/496" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:57:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1582" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: buffer overflow in config_sortlist() due to missing string length check" }, { "cve": "CVE-2022-25881", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2165824" } ], "notes": [ { "category": "description", "text": "A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25881" }, { "category": "external", "summary": "RHBZ#2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:57:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1582" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability" }, { "cve": "CVE-2023-23918", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2171935" } ], "notes": [ { "category": "description", "text": "A privilege escalation vulnerability exists in Node.js \u003c19.6.1, \u003c18.14.1, \u003c16.19.1 and \u003c14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Permissions policies can be bypassed via process.mainModule", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23918" }, { "category": "external", "summary": "RHBZ#2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:57:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1582" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Permissions policies can be bypassed via process.mainModule" }, { "cve": "CVE-2023-23919", "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172170" } ], "notes": [ { "category": "description", "text": "A cryptographic vulnerability exists in Node.js \u003c19.2.0, \u003c18.14.1, \u003c16.19.1, \u003c14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: OpenSSL error handling issues in nodejs crypto library", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23919" }, { "category": "external", "summary": "RHBZ#2172170", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172170" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23919", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23919" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23919", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23919" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:57:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1582" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: OpenSSL error handling issues in nodejs crypto library" }, { "cve": "CVE-2023-23920", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172217" } ], "notes": [ { "category": "description", "text": "An untrusted search path vulnerability exists in Node.js. \u003c19.6.1, \u003c18.14.1, \u003c16.19.1, and \u003c14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23920" }, { "category": "external", "summary": "RHBZ#2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:57:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1582" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: insecure loading of ICU data through ICU_DATA environment variable" }, { "cve": "CVE-2023-23936", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172190" } ], "notes": [ { "category": "description", "text": "A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the \u0027host\u0027 header. This issue could allow HTTP response splitting and HTTP header injection.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Fetch API did not protect against CRLF injection in host headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23936" }, { "category": "external", "summary": "RHBZ#2172190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172190" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23936", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23936" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23936", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23936" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:57:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1582" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Fetch API did not protect against CRLF injection in host headers" }, { "cve": "CVE-2023-24807", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172204" } ], "notes": [ { "category": "description", "text": "Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Regular Expression Denial of Service in Headers fetch API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-24807" }, { "category": "external", "summary": "RHBZ#2172204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172204" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-24807", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24807" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24807", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24807" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-04T09:57:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1582" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debuginfo-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-devel-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-docs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18373+704f5cef.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020230314140722:bd1311ed:npm-1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: Regular Expression Denial of Service in Headers fetch API" } ] }
rhsa-2023_1045
Vulnerability from csaf_redhat
Published
2023-03-01 21:45
Modified
2024-11-25 05:50
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9
Notes
Topic
New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.2 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* keycloak: missing email notification template allowlist (CVE-2022-1274)
* keycloak: minimist: prototype pollution (CVE-2021-44906)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)
* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
* keycloak: path traversal via double URL encoding (CVE-2022-3782)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
* keycloak: reflected XSS attack (CVE-2022-4137)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.2 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n* keycloak: missing email notification template allowlist (CVE-2022-1274)\n* keycloak: minimist: prototype pollution (CVE-2021-44906)\n* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)\n* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)\n* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)\n* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)\n* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)\n* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n* jquery: Passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n* keycloak: reflected XSS attack (CVE-2022-4137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1045", "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1045.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9", "tracking": { "current_release_date": "2024-11-25T05:50:09+00:00", "generator": { "date": "2024-11-25T05:50:09+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1045", "initial_release_date": "2023-03-01T21:45:17+00:00", "revision_history": [ { "date": "2023-03-01T21:45:17+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-01T21:45:17+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-25T05:50:09+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.6 for RHEL 9", "product": { "name": "Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el9sso?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el9sso?arch=noarch" } } }, { "category": "product_version", "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_id": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak-server@18.0.6-1.redhat_00001.1.el9sso?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "relates_to_product_reference": "9Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "relates_to_product_reference": "9Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" }, "product_reference": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "relates_to_product_reference": "9Base-RHSSO-7.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. However, the vulnerability has not been found to be exploitable in reasonable scenarios. \n\nIn RHEL7, pcs-0.9.169-3.el7_9.3 [RHSA-2022:7343] contains an updated version of jquery (3.6.0), which does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "acknowledgments": [ { "names": [ "Marcus Nilsson" ], "organization": "usd AG" } ], "cve": "CVE-2022-1274", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073157" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: HTML injection in execute-actions-email Admin REST API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1274" }, { "category": "external", "summary": "RHBZ#2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1274" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725" } ], "release_date": "2023-02-28T18:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: HTML injection in execute-actions-email Admin REST API" }, { "acknowledgments": [ { "names": [ "Grzegorz Tworek" ], "organization": "SISOFT s.c." } ], "cve": "CVE-2022-1438", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2021-12-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2031904" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS on impersonation under specific circumstances", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1438" }, { "category": "external", "summary": "RHBZ#2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1438", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1438" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438" } ], "release_date": "2023-02-28T18:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS on impersonation under specific circumstances" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-2764", "discovery_date": "2022-08-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2117506" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK from the bytes, causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2764" }, { "category": "external", "summary": "RHBZ#2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2764", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2764" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764" } ], "release_date": "2022-08-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations" }, { "acknowledgments": [ { "names": [ "Peter Flintholm" ], "organization": "Trifork" } ], "cve": "CVE-2022-3916", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2022-11-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2141404" } ], "notes": [ { "category": "description", "text": "A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Session takeover with OIDC offline refreshtokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3916" }, { "category": "external", "summary": "RHBZ#2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3916" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916" } ], "release_date": "2022-11-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: Session takeover with OIDC offline refreshtokens" }, { "cve": "CVE-2022-4137", "cwe": { "id": "CWE-81", "name": "Improper Neutralization of Script in an Error Message Web Page" }, "discovery_date": "2022-11-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2148496" } ], "notes": [ { "category": "description", "text": "A reflected cross-site scripting (XSS) vulnerability was found in the \u0027oob\u0027 OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: reflected XSS attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4137" }, { "category": "external", "summary": "RHBZ#2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4137", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4137" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137" } ], "release_date": "2023-03-01T13:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: reflected XSS attack" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-31129", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-07-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2105075" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service (ReDoS) attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "moment: inefficient parsing algorithm resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse provides the affected software but does not use the functionality and as such its impact has been downgraded to Low.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships a vulnerable version of the moment library. However, this affected functionality is restricted behind OAuth, reducing the impact to Moderate.\n\nRed Hat Satellite ships a vulnerable version of the moment library. However, this only affects a specific component (qpid-dispatch), reducing the impact to Moderate.\n\nRed Hat Ceph Storage (RHCS) ships a vulnerable version of the moment library, however, it is not directly used and is a transitive dependency from Angular. In addition, the impact would only be to the grafana browser, and not the underlying RHCS system, which reduces the impact to Moderate. \n\nRed Hat OpenShift Service Mesh (OSSM) ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nRed Hat OpenShift distributed tracing ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nIn Logging Subsystem for Red Hat OpenShift the vulnerable moment nodejs package is bundled in the ose-logging-kibana6 container as a transitive dependency, hence the direct impact is reduced to Moderate.\n\nIn OpenShift Container Platform 4 the vulnerabile moment package is a third party dependency, hence the direct impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31129" }, { "category": "external", "summary": "RHBZ#2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31129", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g", "url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g" } ], "release_date": "2022-07-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "moment: inefficient parsing algorithm resulting in DoS" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-38749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129706" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38749" }, { "category": "external", "summary": "RHBZ#2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38749", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode" }, { "cve": "CVE-2022-38750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129707" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38750" }, { "category": "external", "summary": "RHBZ#2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38750", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject" }, { "cve": "CVE-2022-38751", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129709" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38751" }, { "category": "external", "summary": "RHBZ#2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "CXF: SSRF Vulnerability" }, { "acknowledgments": [ { "names": [ "Sourav Kumar" ], "organization": "https://github.com/souravs17031999", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0091", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Client Registration endpoint does not check token revocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0091" }, { "category": "external", "summary": "RHBZ#2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0091", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0091" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg" }, { "category": "external", "summary": "https://github.com/keycloak/security/issues/27", "url": "https://github.com/keycloak/security/issues/27" } ], "release_date": "2022-10-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: Client Registration endpoint does not check token revocation" }, { "acknowledgments": [ { "names": [ "Jordi Zayuelas i Mu\u00f1oz" ], "organization": "A1 Digital", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0264", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2023-01-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2160585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: user impersonation via stolen uuid code", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0264" }, { "category": "external", "summary": "RHBZ#2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0264", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0264" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264" } ], "release_date": "2023-02-28T18:58:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: user impersonation via stolen uuid code" } ] }
rhsa-2023_1044
Vulnerability from csaf_redhat
Published
2023-03-01 21:45
Modified
2024-11-25 05:50
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8
Notes
Topic
New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.2 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* keycloak: missing email notification template allowlist (CVE-2022-1274)
* keycloak: minimist: prototype pollution (CVE-2021-44906)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)
* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
* keycloak: path traversal via double URL encoding (CVE-2022-3782)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
* keycloak: reflected XSS attack (CVE-2022-4137)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.2 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n* keycloak: missing email notification template allowlist (CVE-2022-1274)\n* keycloak: minimist: prototype pollution (CVE-2021-44906)\n* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)\n* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)\n* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)\n* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)\n* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)\n* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n* jquery: Passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n* keycloak: reflected XSS attack (CVE-2022-4137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1044", "url": "https://access.redhat.com/errata/RHSA-2023:1044" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1044.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8", "tracking": { "current_release_date": "2024-11-25T05:50:19+00:00", "generator": { "date": "2024-11-25T05:50:19+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1044", "initial_release_date": "2023-03-01T21:45:12+00:00", "revision_history": [ { "date": "2023-03-01T21:45:12+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-01T21:45:12+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-25T05:50:19+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.6 for RHEL 8", "product": { "name": "Red Hat Single Sign-On 7.6 for RHEL 8", "product_id": "8Base-RHSSO-7.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el8sso?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el8sso?arch=noarch" } } }, { "category": "product_version", "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "product": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "product_id": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak-server@18.0.6-1.redhat_00001.1.el8sso?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 8", "product_id": "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "relates_to_product_reference": "8Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 8", "product_id": "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "relates_to_product_reference": "8Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 8", "product_id": "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" }, "product_reference": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "relates_to_product_reference": "8Base-RHSSO-7.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. However, the vulnerability has not been found to be exploitable in reasonable scenarios. \n\nIn RHEL7, pcs-0.9.169-3.el7_9.3 [RHSA-2022:7343] contains an updated version of jquery (3.6.0), which does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "acknowledgments": [ { "names": [ "Marcus Nilsson" ], "organization": "usd AG" } ], "cve": "CVE-2022-1274", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073157" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: HTML injection in execute-actions-email Admin REST API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1274" }, { "category": "external", "summary": "RHBZ#2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1274" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725" } ], "release_date": "2023-02-28T18:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: HTML injection in execute-actions-email Admin REST API" }, { "acknowledgments": [ { "names": [ "Grzegorz Tworek" ], "organization": "SISOFT s.c." } ], "cve": "CVE-2022-1438", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2021-12-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2031904" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS on impersonation under specific circumstances", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1438" }, { "category": "external", "summary": "RHBZ#2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1438", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1438" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438" } ], "release_date": "2023-02-28T18:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS on impersonation under specific circumstances" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-2764", "discovery_date": "2022-08-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2117506" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK from the bytes, causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2764" }, { "category": "external", "summary": "RHBZ#2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2764", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2764" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764" } ], "release_date": "2022-08-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations" }, { "acknowledgments": [ { "names": [ "Peter Flintholm" ], "organization": "Trifork" } ], "cve": "CVE-2022-3916", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2022-11-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2141404" } ], "notes": [ { "category": "description", "text": "A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Session takeover with OIDC offline refreshtokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3916" }, { "category": "external", "summary": "RHBZ#2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3916" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916" } ], "release_date": "2022-11-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: Session takeover with OIDC offline refreshtokens" }, { "cve": "CVE-2022-4137", "cwe": { "id": "CWE-81", "name": "Improper Neutralization of Script in an Error Message Web Page" }, "discovery_date": "2022-11-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2148496" } ], "notes": [ { "category": "description", "text": "A reflected cross-site scripting (XSS) vulnerability was found in the \u0027oob\u0027 OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: reflected XSS attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4137" }, { "category": "external", "summary": "RHBZ#2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4137", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4137" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137" } ], "release_date": "2023-03-01T13:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: reflected XSS attack" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-31129", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-07-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2105075" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service (ReDoS) attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "moment: inefficient parsing algorithm resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse provides the affected software but does not use the functionality and as such its impact has been downgraded to Low.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships a vulnerable version of the moment library. However, this affected functionality is restricted behind OAuth, reducing the impact to Moderate.\n\nRed Hat Satellite ships a vulnerable version of the moment library. However, this only affects a specific component (qpid-dispatch), reducing the impact to Moderate.\n\nRed Hat Ceph Storage (RHCS) ships a vulnerable version of the moment library, however, it is not directly used and is a transitive dependency from Angular. In addition, the impact would only be to the grafana browser, and not the underlying RHCS system, which reduces the impact to Moderate. \n\nRed Hat OpenShift Service Mesh (OSSM) ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nRed Hat OpenShift distributed tracing ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nIn Logging Subsystem for Red Hat OpenShift the vulnerable moment nodejs package is bundled in the ose-logging-kibana6 container as a transitive dependency, hence the direct impact is reduced to Moderate.\n\nIn OpenShift Container Platform 4 the vulnerabile moment package is a third party dependency, hence the direct impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31129" }, { "category": "external", "summary": "RHBZ#2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31129", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g", "url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g" } ], "release_date": "2022-07-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "moment: inefficient parsing algorithm resulting in DoS" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-38749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129706" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38749" }, { "category": "external", "summary": "RHBZ#2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38749", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode" }, { "cve": "CVE-2022-38750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129707" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38750" }, { "category": "external", "summary": "RHBZ#2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38750", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject" }, { "cve": "CVE-2022-38751", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129709" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38751" }, { "category": "external", "summary": "RHBZ#2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "CXF: SSRF Vulnerability" }, { "acknowledgments": [ { "names": [ "Sourav Kumar" ], "organization": "https://github.com/souravs17031999", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0091", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Client Registration endpoint does not check token revocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0091" }, { "category": "external", "summary": "RHBZ#2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0091", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0091" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg" }, { "category": "external", "summary": "https://github.com/keycloak/security/issues/27", "url": "https://github.com/keycloak/security/issues/27" } ], "release_date": "2022-10-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: Client Registration endpoint does not check token revocation" }, { "acknowledgments": [ { "names": [ "Jordi Zayuelas i Mu\u00f1oz" ], "organization": "A1 Digital", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0264", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2023-01-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2160585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: user impersonation via stolen uuid code", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0264" }, { "category": "external", "summary": "RHBZ#2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0264", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0264" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264" } ], "release_date": "2023-02-28T18:58:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:12+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.noarch", "8Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso.src", "8Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el8sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: user impersonation via stolen uuid code" } ] }
rhsa-2023_0934
Vulnerability from csaf_redhat
Published
2023-02-28 00:50
Modified
2024-11-24 20:42
Summary
Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update
Notes
Topic
Migration Toolkit for Applications 6.0.1 release
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details
Migration Toolkit for Applications 6.0.1 Images
Security Fix(es) from Bugzilla:
* loader-utils: prototype pollution in function parseQuery in parseQuery.js (CVE-2022-37601)
* Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing (CVE-2022-42920)
* gin: Unsanitized input in the default logger in github.com/gin-gonic/gin (CVE-2020-36567)
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
* loader-utils:Regular expression denial of service (CVE-2022-37603)
* golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Migration Toolkit for Applications 6.0.1 release\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Migration Toolkit for Applications 6.0.1 Images\n\nSecurity Fix(es) from Bugzilla:\n\n* loader-utils: prototype pollution in function parseQuery in parseQuery.js (CVE-2022-37601)\n\n* Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing (CVE-2022-42920)\n\n* gin: Unsanitized input in the default logger in github.com/gin-gonic/gin (CVE-2020-36567)\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* loader-utils:Regular expression denial of service (CVE-2022-37603)\n\n* golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)\n\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0934", "url": "https://access.redhat.com/errata/RHSA-2023:0934" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2134876", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134876" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2142707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142707" }, { "category": "external", "summary": "2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2156683", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156683" }, { "category": "external", "summary": "2161274", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274" }, { "category": "external", "summary": "MTA-103", "url": "https://issues.redhat.com/browse/MTA-103" }, { "category": "external", "summary": "MTA-106", "url": "https://issues.redhat.com/browse/MTA-106" }, { "category": "external", "summary": "MTA-122", "url": "https://issues.redhat.com/browse/MTA-122" }, { "category": "external", "summary": "MTA-123", "url": "https://issues.redhat.com/browse/MTA-123" }, { "category": "external", "summary": "MTA-127", "url": "https://issues.redhat.com/browse/MTA-127" }, { "category": "external", "summary": "MTA-131", "url": "https://issues.redhat.com/browse/MTA-131" }, { "category": "external", "summary": "MTA-36", "url": "https://issues.redhat.com/browse/MTA-36" }, { "category": "external", "summary": "MTA-44", "url": "https://issues.redhat.com/browse/MTA-44" }, { "category": "external", "summary": "MTA-49", "url": "https://issues.redhat.com/browse/MTA-49" }, { "category": "external", "summary": "MTA-59", "url": "https://issues.redhat.com/browse/MTA-59" }, { "category": "external", "summary": "MTA-65", "url": "https://issues.redhat.com/browse/MTA-65" }, { "category": "external", "summary": "MTA-72", "url": "https://issues.redhat.com/browse/MTA-72" }, { "category": "external", "summary": "MTA-73", "url": "https://issues.redhat.com/browse/MTA-73" }, { "category": "external", "summary": "MTA-74", "url": "https://issues.redhat.com/browse/MTA-74" }, { "category": "external", "summary": "MTA-76", "url": "https://issues.redhat.com/browse/MTA-76" }, { "category": "external", "summary": "MTA-77", "url": "https://issues.redhat.com/browse/MTA-77" }, { "category": "external", "summary": "MTA-80", "url": "https://issues.redhat.com/browse/MTA-80" }, { "category": "external", "summary": "MTA-82", "url": "https://issues.redhat.com/browse/MTA-82" }, { "category": "external", "summary": "MTA-85", "url": "https://issues.redhat.com/browse/MTA-85" }, { "category": "external", "summary": "MTA-88", "url": "https://issues.redhat.com/browse/MTA-88" }, { "category": "external", "summary": "MTA-92", "url": "https://issues.redhat.com/browse/MTA-92" }, { "category": "external", "summary": "MTA-96", "url": "https://issues.redhat.com/browse/MTA-96" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0934.json" } ], "title": "Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update", "tracking": { "current_release_date": "2024-11-24T20:42:48+00:00", "generator": { "date": "2024-11-24T20:42:48+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:0934", "initial_release_date": "2023-02-28T00:50:28+00:00", "revision_history": [ { "date": "2023-02-28T00:50:28+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-02-28T23:46:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:42:48+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "MTA 6.0 for RHEL 8", "product": { "name": "MTA 6.0 for RHEL 8", "product_id": "8Base-MTA-6.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:migration_toolkit_applications:6.0::el8" } } } ], "category": "product_family", "name": "Migration Toolkit for Applications" }, { "branches": [ { "category": "product_version", "name": "mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "product": { "name": "mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "product_id": "mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "product_identification_helper": { "purl": "pkg:oci/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-admin-addon-rhel8\u0026tag=6.0.1-8" } } }, { "category": "product_version", "name": "mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "product": { "name": "mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "product_id": "mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "product_identification_helper": { "purl": "pkg:oci/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-hub-rhel8\u0026tag=6.0.1-8" } } }, { "category": "product_version", "name": "mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "product": { "name": "mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "product_id": "mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "product_identification_helper": { "purl": "pkg:oci/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-rhel8-operator\u0026tag=6.0.1-8" } } }, { "category": "product_version", "name": "mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "product": { "name": "mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "product_id": "mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "product_identification_helper": { "purl": "pkg:oci/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-pathfinder-rhel8\u0026tag=6.0.1-6" } } }, { "category": "product_version", "name": "mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64", "product": { "name": "mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64", "product_id": "mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64", "product_identification_helper": { "purl": "pkg:oci/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-ui-rhel8\u0026tag=6.0.1-10" } } }, { "category": "product_version", "name": "mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64", "product": { "name": "mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64", "product_id": "mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64", "product_identification_helper": { "purl": "pkg:oci/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-windup-addon-rhel8\u0026tag=6.0.1-9" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64 as a component of MTA 6.0 for RHEL 8", "product_id": "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64" }, "product_reference": "mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "relates_to_product_reference": "8Base-MTA-6.0" }, { "category": "default_component_of", "full_product_name": { "name": "mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64 as a component of MTA 6.0 for RHEL 8", "product_id": "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64" }, "product_reference": "mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "relates_to_product_reference": "8Base-MTA-6.0" }, { "category": "default_component_of", "full_product_name": { "name": "mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64 as a component of MTA 6.0 for RHEL 8", "product_id": "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64" }, "product_reference": "mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "relates_to_product_reference": "8Base-MTA-6.0" }, { "category": "default_component_of", "full_product_name": { "name": "mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64 as a component of MTA 6.0 for RHEL 8", "product_id": "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64" }, "product_reference": "mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "relates_to_product_reference": "8Base-MTA-6.0" }, { "category": "default_component_of", "full_product_name": { "name": "mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64 as a component of MTA 6.0 for RHEL 8", "product_id": "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" }, "product_reference": "mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64", "relates_to_product_reference": "8Base-MTA-6.0" }, { "category": "default_component_of", "full_product_name": { "name": "mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64 as a component of MTA 6.0 for RHEL 8", "product_id": "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" }, "product_reference": "mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64", "relates_to_product_reference": "8Base-MTA-6.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-36567", "cwe": { "id": "CWE-117", "name": "Improper Output Neutralization for Logs" }, "discovery_date": "2022-12-28T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156683" } ], "notes": [ { "category": "description", "text": "A flaw was found in gin. This issue occurs when the default Formatter for the Logger middleware (LoggerConfig.Formatter), which is included in the Default engine, allows attackers to inject arbitrary log entries by manipulating the request path.", "title": "Vulnerability description" }, { "category": "summary", "text": "gin: Unsanitized input in the default logger in github.com/gin-gonic/gin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ], "known_not_affected": [ "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-36567" }, { "category": "external", "summary": "RHBZ#2156683", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156683" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-36567", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36567" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-36567", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36567" }, { "category": "external", "summary": "https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d", "url": "https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d" }, { "category": "external", "summary": "https://github.com/gin-gonic/gin/pull/2237", "url": "https://github.com/gin-gonic/gin/pull/2237" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2020-0001", "url": "https://pkg.go.dev/vuln/GO-2020-0001" } ], "release_date": "2022-12-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-28T00:50:28+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0934" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "gin: Unsanitized input in the default logger in github.com/gin-gonic/gin" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "known_not_affected": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-28T00:50:28+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0934" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2022-24999", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-02T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150323" } ], "notes": [ { "category": "description", "text": "A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "express: \"qs\" prototype poisoning causes the hang of the node process", "title": "Vulnerability summary" }, { "category": "other", "text": "- The qs and express Package is not used by the OpenShift Container Platform console directly and is only a third-party package dependency. Hence, it is marked as wontfix. \nAs a result, any services that depend on Openshift for their use of qs and express are marked won\u0027t fix. \n- In OpenShift Service Mesh, \u0027qs\u0027 is hoisted from storybook and node-sass, both are dev dependencies, and the vulnerability is not exposed to end users. Hence marked as wontfix.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "known_not_affected": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24999" }, { "category": "external", "summary": "RHBZ#2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24999", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24999" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999" }, { "category": "external", "summary": "https://github.com/expressjs/express/releases/tag/4.17.3", "url": "https://github.com/expressjs/express/releases/tag/4.17.3" }, { "category": "external", "summary": "https://github.com/ljharb/qs/pull/428", "url": "https://github.com/ljharb/qs/pull/428" }, { "category": "external", "summary": "https://github.com/n8tz/CVE-2022-24999", "url": "https://github.com/n8tz/CVE-2022-24999" } ], "release_date": "2022-11-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-28T00:50:28+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0934" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "express: \"qs\" prototype poisoning causes the hang of the node process" }, { "cve": "CVE-2022-37601", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-10-14T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134876" } ], "notes": [ { "category": "description", "text": "A prototype pollution vulnerability was found in the parseQuery function in parseQuery.js in the webpack loader-utils via the name variable in parseQuery.js. This flaw can lead to a denial of service or remote code execution.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: prototype pollution in function parseQuery in parseQuery.js", "title": "Vulnerability summary" }, { "category": "other", "text": "Packages shipped in Red Hat Enterprise Linux use \u0027loader-utils\u0027 as a transitive dependency. Thus, reducing the impact to Moderate.\n\nIn Red Hat containerized products like OCP and ODF, the vulnerable loader-utils NodeJS module is bundled as a transitive dependency, hence the direct impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "known_not_affected": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37601" }, { "category": "external", "summary": "RHBZ#2134876", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134876" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37601", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37601" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37601", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37601" }, { "category": "external", "summary": "https://github.com/webpack/loader-utils/issues/212", "url": "https://github.com/webpack/loader-utils/issues/212" } ], "release_date": "2022-10-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-28T00:50:28+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0934" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: prototype pollution in function parseQuery in parseQuery.js" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "known_not_affected": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-28T00:50:28+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0934" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-41717", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-01-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2161274" } ], "notes": [ { "category": "description", "text": "A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Within Red Hat OpenShift Container Platform, the grafana container is listed as will not fix. Since OCP 4.10, Grafana itself is not shipped and the Grafana web server is protected behind an OAuth proxy server.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ], "known_not_affected": [ "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41717" }, { "category": "external", "summary": "RHBZ#2161274", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41717", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41717" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717" }, { "category": "external", "summary": "https://go.dev/cl/455635", "url": "https://go.dev/cl/455635" }, { "category": "external", "summary": "https://go.dev/cl/455717", "url": "https://go.dev/cl/455717" }, { "category": "external", "summary": "https://go.dev/issue/56350", "url": "https://go.dev/issue/56350" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ", "url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2022-1144", "url": "https://pkg.go.dev/vuln/GO-2022-1144" } ], "release_date": "2022-11-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-28T00:50:28+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0934" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests" }, { "cve": "CVE-2022-42920", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-11-07T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2142707" } ], "notes": [ { "category": "description", "text": "An out-of-bounds (OOB) write flaw was found in Apache Commons BCEL API. This flaw can be used to produce arbitrary bytecode and may abuse applications that pass attacker-controlled data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected.", "title": "Vulnerability description" }, { "category": "summary", "text": "Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing", "title": "Vulnerability summary" }, { "category": "other", "text": "Fuse 7 ships the code in question but does not utilize it in the product, so it is affected at a reduced impact of Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "known_not_affected": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42920" }, { "category": "external", "summary": "RHBZ#2142707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42920", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42920" }, { "category": "external", "summary": "https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4", "url": "https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-28T00:50:28+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0934" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "known_not_affected": [ "8Base-MTA-6.0:mta/mta-admin-addon-rhel8@sha256:9445191232ad1ff1c2926b5a2194130502696a74620cda941675edc9c366b305_amd64", "8Base-MTA-6.0:mta/mta-hub-rhel8@sha256:ebc8706761a518bd08447a6e51a35f81e5beb3840f3b6b66f656c23c36c07e76_amd64", "8Base-MTA-6.0:mta/mta-pathfinder-rhel8@sha256:b50244562f83977574d1bd88adc1d259501c90f883596b15fa81e557844e2956_amd64", "8Base-MTA-6.0:mta/mta-rhel8-operator@sha256:7f145fc5723fd09324500de359146c2967a8b8f960dac4b862352faf2cb592c4_amd64", "8Base-MTA-6.0:mta/mta-windup-addon-rhel8@sha256:9a912e054a7c46e07bdbfeb165f0e71ff3686bcdba9cd53d0ed6be8ff0607108_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-28T00:50:28+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0934" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-MTA-6.0:mta/mta-ui-rhel8@sha256:e00e79bc7fb1bc104b1d3e0ebc6b49c7d3c7885925e3c432d60b43f10aaec1c4_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" } ] }
rhsa-2023_1743
Vulnerability from csaf_redhat
Published
2023-04-12 15:03
Modified
2024-11-24 20:44
Summary
Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (14.21.3).
Security Fix(es):
* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.3).\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1743", "url": "https://access.redhat.com/errata/RHSA-2023:1743" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "2175826", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2175826" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1743.json" } ], "title": "Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-24T20:44:31+00:00", "generator": { "date": "2024-11-24T20:44:31+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1743", "initial_release_date": "2023-04-12T15:03:07+00:00", "revision_history": [ { "date": "2023-04-12T15:03:07+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-04-12T15:03:07+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:44:31+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:14:8070020230306170042:bd1311ed", "product": { "name": "nodejs:14:8070020230306170042:bd1311ed", "product_id": "nodejs:14:8070020230306170042:bd1311ed", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@14:8070020230306170042:bd1311ed" } } }, { "category": "product_version", "name": "nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "product": { "name": "nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "product_id": "nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product_id": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "product": { "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "product_id": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product": { "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_id": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product": { "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product_id": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product_id": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.7.0%2B18531%2B81d21ca6?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, "product_reference": "nodejs:14:8070020230306170042:bd1311ed", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch" }, "product_reference": "nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64 as a component of nodejs:14:8070020230306170042:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:03:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1743" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:03:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1743" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-4904", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2023-02-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168631" } ], "notes": [ { "category": "description", "text": "A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: buffer overflow in config_sortlist() due to missing string length check", "title": "Vulnerability summary" }, { "category": "other", "text": "The severity of this vulnerability is not important but moderate because exploiting the vulnerability can lead to a disruption of the availability of an application, yet doesn\u2019t compromise data integrity or confidentiality. The opportunity for disruption is further limited due to the requirement that an application allows an attacker to be able to input both untrusted and unvalidated data. Exploiting this flaw requires an application to use the library in such a way that would allow untrusted and unvalidated input to be passed directly to ares_set_sortlist by an attacker. In the event that this is able to occur, the impact to RHEL is limited to a crash of the application due to the protections offered by default in RHEL systems such as Stack Smashing Protection (SSP).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4904" }, { "category": "external", "summary": "RHBZ#2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4904", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4904" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904" }, { "category": "external", "summary": "https://github.com/c-ares/c-ares/issues/496", "url": "https://github.com/c-ares/c-ares/issues/496" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:03:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1743" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: buffer overflow in config_sortlist() due to missing string length check" }, { "cve": "CVE-2022-25881", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2165824" } ], "notes": [ { "category": "description", "text": "A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25881" }, { "category": "external", "summary": "RHBZ#2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:03:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1743" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability" }, { "cve": "CVE-2022-38900", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2023-02-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2170644" } ], "notes": [ { "category": "description", "text": "A flaw was found in decode-uri-component. This issue occurs due to a specially crafted input, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "decode-uri-component: improper input validation resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "For OpenShift Container Platform (OCP), Advanced Clusters Management for Kubernetes (ACM) and Advanced Cluster Security (ACS), the NPM decode-uri-component package is only present in source repositories as a development dependency, it is not used in production. Therefore this vulnerability is rated Low for OCP and ACS.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the decode-uri-component package. \nThe vulnerable code is not used, hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38900" }, { "category": "external", "summary": "RHBZ#2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38900", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38900" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900" }, { "category": "external", "summary": "https://github.com/SamVerschueren/decode-uri-component/issues/5", "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq" } ], "release_date": "2022-11-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:03:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1743" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "decode-uri-component: improper input validation resulting in DoS" }, { "cve": "CVE-2023-23918", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2171935" } ], "notes": [ { "category": "description", "text": "A privilege escalation vulnerability exists in Node.js \u003c19.6.1, \u003c18.14.1, \u003c16.19.1 and \u003c14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Permissions policies can be bypassed via process.mainModule", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23918" }, { "category": "external", "summary": "RHBZ#2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:03:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1743" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Permissions policies can be bypassed via process.mainModule" }, { "cve": "CVE-2023-23920", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172217" } ], "notes": [ { "category": "description", "text": "An untrusted search path vulnerability exists in Node.js. \u003c19.6.1, \u003c18.14.1, \u003c16.19.1, and \u003c14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23920" }, { "category": "external", "summary": "RHBZ#2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:03:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1743" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debuginfo-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-debugsource-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-devel-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-docs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-full-i18n-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-nodemon-0:2.0.20-3.module+el8.7.0+18531+81d21ca6.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020230306170042:bd1311ed:npm-1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: insecure loading of ICU data through ICU_DATA environment variable" } ] }
gsd-2021-35065
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2021-35065", "id": "GSD-2021-35065", "references": [ "https://access.redhat.com/errata/RHSA-2023:0612", "https://access.redhat.com/errata/RHSA-2023:0634", "https://access.redhat.com/errata/RHSA-2023:0934", "https://access.redhat.com/errata/RHSA-2023:1043", "https://access.redhat.com/errata/RHSA-2023:1044", "https://access.redhat.com/errata/RHSA-2023:1045", "https://access.redhat.com/errata/RHSA-2023:1047", "https://access.redhat.com/errata/RHSA-2023:1049" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2021-35065" ], "details": "The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.", "id": "GSD-2021-35065", "modified": "2023-12-13T01:23:27.753493Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-35065", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_affected": "?", "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "refsource": "MISC", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" }, { "name": "https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339", "refsource": "MISC", "url": "https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339" }, { "name": "https://github.com/gulpjs/glob-parent/pull/49", "refsource": "MISC", "url": "https://github.com/gulpjs/glob-parent/pull/49" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "\u003e=6.0.0 \u003c6.0.1", "affected_versions": "All versions starting from 6.0.0 before 6.0.1", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cwe_ids": [ "CWE-1035", "CWE-1333", "CWE-937" ], "date": "2023-01-23", "description": "The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.", "fixed_versions": [ "6.0.1" ], "identifier": "CVE-2021-35065", "identifiers": [ "CVE-2021-35065", "GHSA-cj88-88mr-972w", "GMS-2022-3113" ], "not_impacted": "All versions before 6.0.0, all versions starting from 6.0.1", "package_slug": "npm/glob-parent", "pubdate": "2022-12-26", "solution": "Upgrade to version 6.0.1 or above.", "title": "Inefficient Regular Expression Complexity", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339", "https://github.com/gulpjs/glob-parent/pull/49", "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1103", "https://www.mend.io/vulnerability-database/CVE-2021-35065", "https://github.com/gulpjs/glob-parent/pull/36", "https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2", "https://github.com/gulpjs/glob-parent/releases/tag/v6.0.1", "https://github.com/advisories/GHSA-cj88-88mr-972w" ], "uuid": "38f7a754-3564-41ec-a0be-f9ac5360ebcf" }, { "affected_range": "\u003c0", "affected_versions": "All versions before 5.1.2, version 6.0.0", "cwe_ids": [ "CWE-1035", "CWE-937" ], "date": "2022-07-19", "description": "glob-parent before 6.0.1 and 5.1.2 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1 and 5.1.2.", "fixed_versions": [ "5.1.2", "6.0.1" ], "identifier": "GMS-2022-3113", "identifiers": [ "GHSA-cj88-88mr-972w", "GMS-2022-3113", "CVE-2021-35065" ], "not_impacted": "All versions starting from 5.1.2 before 6.0.0, all versions after 6.0.0", "package_slug": "npm/glob-parent", "pubdate": "2022-07-18", "solution": "Upgrade to versions 5.1.2, 6.0.1 or above.", "title": "Duplicate of ./npm/glob-parent/CVE-2021-35065.yml", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1103", "https://github.com/gulpjs/glob-parent/pull/49", "https://www.mend.io/vulnerability-database/CVE-2021-35065", "https://github.com/gulpjs/glob-parent/pull/36", "https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2", "https://github.com/gulpjs/glob-parent/releases/tag/v6.0.1", "https://github.com/advisories/GHSA-cj88-88mr-972w" ], "uuid": "d179a62d-e731-4841-b6e3-e18b7608ff11" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:gulpjs:glob-parent:*:*:*:*:*:node.js:*:*", "cpe_name": [], "versionEndExcluding": "6.0.1", "versionStartIncluding": "6.0.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-35065" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-1333" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339", "refsource": "CONFIRM", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339" }, { "name": "https://github.com/gulpjs/glob-parent/pull/49", "refsource": "CONFIRM", "tags": [ "Exploit", "Patch", "Third Party Advisory" ], "url": "https://github.com/gulpjs/glob-parent/pull/49" }, { "name": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "refsource": "MISC", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ] } }, "impact": { "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } }, "lastModifiedDate": "2023-01-23T18:32Z", "publishedDate": "2022-12-26T07:15Z" } } }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.