Action not permitted
Modal body text goes here.
CVE-2022-43548
Vulnerability from cvelistv5
Published
2022-12-05 00:00
Modified
2024-08-03 13:32
Severity ?
EPSS score ?
Summary
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
References
▼ | URL | Tags | |
---|---|---|---|
support@hackerone.com | https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html | Mailing List, Third Party Advisory | |
support@hackerone.com | https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/ | Patch, Vendor Advisory | |
support@hackerone.com | https://security.netapp.com/advisory/ntap-20230120-0004/ | Third Party Advisory | |
support@hackerone.com | https://security.netapp.com/advisory/ntap-20230427-0007/ | ||
support@hackerone.com | https://www.debian.org/security/2023/dsa-5326 | Third Party Advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
n/a | https://github.com/nodejs/node |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T13:32:59.546Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20230120-0004/" }, { "name": "DSA-5326", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.debian.org/security/2023/dsa-5326" }, { "name": "[debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20230427-0007/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "https://github.com/nodejs/node", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Fixed in 19.0.1, 18.12.1, 16.18.1, 14.21.1" } ] } ], "descriptions": [ { "lang": "en", "value": "A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-78", "description": "OS Command Injection (CWE-78)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-27T00:00:00", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone" }, "references": [ { "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/" }, { "url": "https://security.netapp.com/advisory/ntap-20230120-0004/" }, { "name": "DSA-5326", "tags": [ "vendor-advisory" ], "url": "https://www.debian.org/security/2023/dsa-5326" }, { "name": "[debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html" }, { "url": "https://security.netapp.com/advisory/ntap-20230427-0007/" } ] } }, "cveMetadata": { "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2022-43548", "datePublished": "2022-12-05T00:00:00", "dateReserved": "2022-10-20T00:00:00", "dateUpdated": "2024-08-03T13:32:59.546Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-43548\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2022-12-05T22:15:10.923\",\"lastModified\":\"2023-04-27T15:15:09.797\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad de inyecci\u00f3n de comandos del Sistema Operativo en las versiones de Node.js \u0026lt;14.21.1, \u0026lt;16.18.1, \u0026lt;18.12.1, \u0026lt;19.0.1 debido a una verificaci\u00f3n insuficiente de IsAllowedHost que se puede omitir f\u00e1cilmente porque IsIPAddress no lo hace correctamente. verifique si una direcci\u00f3n IP no es v\u00e1lida antes de realizar solicitudes de DBS que permitan volver a vincular ataques. La soluci\u00f3n para este problema en https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 estaba incompleta y esto El nuevo CVE es para completar la soluci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]},{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"14.0.0\",\"versionEndIncluding\":\"14.14.0\",\"matchCriteriaId\":\"428DCD7B-6F66-4F18-B780-5BD80143D482\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"14.15.0\",\"versionEndExcluding\":\"14.21.1\",\"matchCriteriaId\":\"BE09F669-5369-442E-8B63-BF58FC0CBB22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"16.0.0\",\"versionEndIncluding\":\"16.12.0\",\"matchCriteriaId\":\"1D1D0CEC-62E5-4368-B8F2-1DA5DD0B88FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"16.13.0\",\"versionEndExcluding\":\"16.18.1\",\"matchCriteriaId\":\"FF081B38-0E73-4066-898D-12C6B6D48913\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"18.0.0\",\"versionEndIncluding\":\"18.11.0\",\"matchCriteriaId\":\"33DB62F6-9D8D-42F8-A75E-82DA091C02BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"7B1F87EE-4E30-4832-BF01-8501E94380EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:19.0.0:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"F568BBC5-0D8E-499C-9F3E-DDCE5F10F9D5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html\",\"source\":\"support@hackerone.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20230120-0004/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20230427-0007/\",\"source\":\"support@hackerone.com\"},{\"url\":\"https://www.debian.org/security/2023/dsa-5326\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
rhsa-2022_8833
Vulnerability from csaf_redhat
Published
2022-12-06 15:39
Modified
2024-11-22 21:44
Summary
Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (18.12.1), nodejs-nodemon (2.0.20). (BZ#2142818)
Security Fix(es):
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.12.1), nodejs-nodemon (2.0.20). (BZ#2142818)\n\nSecurity Fix(es):\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:8833", "url": "https://access.redhat.com/errata/RHSA-2022:8833" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142818", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142818" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8833.json" } ], "title": "Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T21:44:00+00:00", "generator": { "date": "2024-11-22T21:44:00+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2022:8833", "initial_release_date": "2022-12-06T15:39:50+00:00", "revision_history": [ { "date": "2022-12-06T15:39:50+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-12-06T15:39:50+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T21:44:00+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:18:8070020221118123310:bd1311ed", "product": { "name": "nodejs:18:8070020221118123310:bd1311ed", "product_id": "nodejs:18:8070020221118123310:bd1311ed", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@18:8070020221118123310:bd1311ed" } } }, { "category": "product_version", "name": "nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch", "product": { "name": "nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch", "product_id": "nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch", "product_id": "nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-1.module%2Bel8.7.0%2B17282%2Bf47dd33b?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product": { "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product_id": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel8.7.0%2B15582%2B19c314fa?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product": { "name": "nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product_id": "nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-4.module%2Bel8.7.0%2B15582%2B19c314fa?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product": { "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product_id": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product": { "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product_id": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product": { "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product_id": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product": { "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product_id": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product": { "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product_id": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64", "product": { "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64", "product_id": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.18.12.1.2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src", "product": { "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src", "product_id": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src", "product": { "name": "nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src", "product_id": "nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-1.module%2Bel8.7.0%2B17282%2Bf47dd33b?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "product": { "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "product_id": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel8.7.0%2B15582%2B19c314fa?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product": { "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product_id": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product": { "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product_id": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product": { "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product_id": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product": { "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product_id": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product": { "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product_id": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le", "product": { "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le", "product_id": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.18.12.1.2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product": { "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product_id": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product": { "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product_id": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product": { "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product_id": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product": { "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product_id": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product": { "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product_id": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x", "product": { "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x", "product_id": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.18.12.1.2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product": { "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product_id": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product": { "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product_id": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product": { "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product_id": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product": { "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product_id": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product": { "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product_id": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.12.1-2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64", "product": { "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64", "product_id": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.18.12.1.2.module%2Bel8.7.0%2B17306%2Bfc023f99?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, "product_reference": "nodejs:18:8070020221118123310:bd1311ed", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64" }, "product_reference": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le" }, "product_reference": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x" }, "product_reference": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src" }, "product_reference": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64" }, "product_reference": "nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64" }, "product_reference": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le" }, "product_reference": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x" }, "product_reference": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64" }, "product_reference": "nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64" }, "product_reference": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le" }, "product_reference": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x" }, "product_reference": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64" }, "product_reference": "nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64" }, "product_reference": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le" }, "product_reference": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x" }, "product_reference": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64" }, "product_reference": "nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch" }, "product_reference": "nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64" }, "product_reference": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le" }, "product_reference": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x" }, "product_reference": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64" }, "product_reference": "nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch" }, "product_reference": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src" }, "product_reference": "nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch" }, "product_reference": "nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64" }, "product_reference": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le" }, "product_reference": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x" }, "product_reference": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64 as a component of nodejs:18:8070020221118123310:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64" }, "product_reference": "npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-06T15:39:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:8833" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-06T15:39:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:8833" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debuginfo-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-debugsource-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-devel-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-docs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-full-i18n-1:18.12.1-2.module+el8.7.0+17306+fc023f99.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-nodemon-0:2.0.20-1.module+el8.7.0+17282+f47dd33b.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-0:2021.06-4.module+el8.7.0+15582+19c314fa.src", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+15582+19c314fa.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:18:8070020221118123310:bd1311ed:npm-1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" } ] }
rhsa-2023_0321
Vulnerability from csaf_redhat
Published
2023-01-23 15:20
Modified
2024-11-22 21:54
Summary
Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update
Notes
Topic
An update for nodejs and nodejs-nodemon is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (16.18.1), nodejs-nodemon (2.0.20).
Security Fix(es):
* minimist: prototype pollution (CVE-2021-44906)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* nodejs: Packaged version of undici does not fit with declared version. [rhel-9] (BZ#2151627)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for nodejs and nodejs-nodemon is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs: Packaged version of undici does not fit with declared version. [rhel-9] (BZ#2151627)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0321", "url": "https://access.redhat.com/errata/RHSA-2023:0321" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142808", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142808" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0321.json" } ], "title": "Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T21:54:19+00:00", "generator": { "date": "2024-11-22T21:54:19+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:0321", "initial_release_date": "2023-01-23T15:20:34+00:00", "revision_history": [ { "date": "2023-01-23T15:20:34+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-01-23T15:20:34+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T21:54:19+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.el9_1.src", "product": { "name": "nodejs-nodemon-0:2.0.20-2.el9_1.src", "product_id": "nodejs-nodemon-0:2.0.20-2.el9_1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.el9_1?arch=src" } } }, { "category": "product_version", "name": "nodejs-1:16.18.1-3.el9_1.src", "product": { "name": "nodejs-1:16.18.1-3.el9_1.src", "product_id": "nodejs-1:16.18.1-3.el9_1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.el9_1?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "product_id": "nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.el9_1?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-docs-1:16.18.1-3.el9_1.noarch", "product": { "name": "nodejs-docs-1:16.18.1-3.el9_1.noarch", "product_id": "nodejs-docs-1:16.18.1-3.el9_1.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@16.18.1-3.el9_1?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.el9_1.aarch64", "product": { "name": "nodejs-1:16.18.1-3.el9_1.aarch64", "product_id": "nodejs-1:16.18.1-3.el9_1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.el9_1?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "product_id": "nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.el9_1?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.18.1-3.el9_1.aarch64", "product": { "name": "nodejs-libs-1:16.18.1-3.el9_1.aarch64", "product_id": "nodejs-libs-1:16.18.1-3.el9_1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs@16.18.1-3.el9_1?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "product_id": "npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.el9_1?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "product": { "name": "nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "product_id": "nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.el9_1?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "product_id": "nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.el9_1?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "product": { "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "product_id": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@16.18.1-3.el9_1?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.el9_1.ppc64le", "product": { "name": "nodejs-1:16.18.1-3.el9_1.ppc64le", "product_id": "nodejs-1:16.18.1-3.el9_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.el9_1?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "product_id": "nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.el9_1?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "product": { "name": "nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "product_id": "nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs@16.18.1-3.el9_1?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "product_id": "npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.el9_1?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "product": { "name": "nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "product_id": "nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.el9_1?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "product_id": "nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.el9_1?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "product": { "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "product_id": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@16.18.1-3.el9_1?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.el9_1.x86_64", "product": { "name": "nodejs-1:16.18.1-3.el9_1.x86_64", "product_id": "nodejs-1:16.18.1-3.el9_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.el9_1?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "product_id": "nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.el9_1?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.18.1-3.el9_1.x86_64", "product": { "name": "nodejs-libs-1:16.18.1-3.el9_1.x86_64", "product_id": "nodejs-libs-1:16.18.1-3.el9_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs@16.18.1-3.el9_1?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64", "product_id": "npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.el9_1?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "product": { "name": "nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "product_id": "nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.el9_1?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "product_id": "nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.el9_1?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "product": { "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "product_id": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@16.18.1-3.el9_1?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nodejs-libs-1:16.18.1-3.el9_1.i686", "product": { "name": "nodejs-libs-1:16.18.1-3.el9_1.i686", "product_id": "nodejs-libs-1:16.18.1-3.el9_1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs@16.18.1-3.el9_1?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.el9_1.i686", "product": { "name": "nodejs-debugsource-1:16.18.1-3.el9_1.i686", "product_id": "nodejs-debugsource-1:16.18.1-3.el9_1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.el9_1?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "product_id": "nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.el9_1?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "product": { "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "product_id": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@16.18.1-3.el9_1?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.el9_1.s390x", "product": { "name": "nodejs-1:16.18.1-3.el9_1.s390x", "product_id": "nodejs-1:16.18.1-3.el9_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.el9_1?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "product_id": "nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.el9_1?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.18.1-3.el9_1.s390x", "product": { "name": "nodejs-libs-1:16.18.1-3.el9_1.s390x", "product_id": "nodejs-libs-1:16.18.1-3.el9_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs@16.18.1-3.el9_1?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "product_id": "npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.el9_1?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "product": { "name": "nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "product_id": "nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.el9_1?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "product_id": "nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.el9_1?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "product": { "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "product_id": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@16.18.1-3.el9_1?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64" }, "product_reference": "nodejs-1:16.18.1-3.el9_1.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le" }, "product_reference": "nodejs-1:16.18.1-3.el9_1.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x" }, "product_reference": "nodejs-1:16.18.1-3.el9_1.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.el9_1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src" }, "product_reference": "nodejs-1:16.18.1-3.el9_1.src", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64" }, "product_reference": "nodejs-1:16.18.1-3.el9_1.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.el9_1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.el9_1.i686", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:16.18.1-3.el9_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch" }, "product_reference": "nodejs-docs-1:16.18.1-3.el9_1.noarch", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.18.1-3.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64" }, "product_reference": "nodejs-libs-1:16.18.1-3.el9_1.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.18.1-3.el9_1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686" }, "product_reference": "nodejs-libs-1:16.18.1-3.el9_1.i686", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.18.1-3.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le" }, "product_reference": "nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.18.1-3.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x" }, "product_reference": "nodejs-libs-1:16.18.1-3.el9_1.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.18.1-3.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64" }, "product_reference": "nodejs-libs-1:16.18.1-3.el9_1.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64" }, "product_reference": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686" }, "product_reference": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le" }, "product_reference": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x" }, "product_reference": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64" }, "product_reference": "nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.el9_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.el9_1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.el9_1.src", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-23T15:20:34+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0321" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-23T15:20:34+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0321" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "acknowledgments": [ { "names": [ "VVX7" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2022-35256", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2022-09-28T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2130518" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ], "known_not_affected": [ "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-35256" }, { "category": "external", "summary": "RHBZ#2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-35256", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256", "url": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256" } ], "release_date": "2022-09-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-23T15:20:34+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0321" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ], "known_not_affected": [ "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-nodemon-0:2.0.20-2.el9_1.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-23T15:20:34+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0321" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.src", "AppStream-9.1.0.Z.MAIN:nodejs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-debugsource-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-docs-1:16.18.1-3.el9_1.noarch", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-full-i18n-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.i686", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:nodejs-libs-debuginfo-1:16.18.1-3.el9_1.x86_64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.aarch64", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.ppc64le", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.s390x", "AppStream-9.1.0.Z.MAIN:npm-1:8.19.2-1.16.18.1.3.el9_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" } ] }
rhsa-2023_1533
Vulnerability from csaf_redhat
Published
2023-03-30 13:06
Modified
2024-11-24 20:44
Summary
Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (14.21.3).
Security Fix(es):
* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* minimist: prototype pollution (CVE-2021-44906)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
* express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.3).\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1533", "url": "https://access.redhat.com/errata/RHSA-2023:1533" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142823", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142823" }, { "category": "external", "summary": "2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "2175828", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2175828" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1533.json" } ], "title": "Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-24T20:44:39+00:00", "generator": { "date": "2024-11-24T20:44:39+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1533", "initial_release_date": "2023-03-30T13:06:07+00:00", "revision_history": [ { "date": "2023-03-30T13:06:07+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-30T13:06:07+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:44:39+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.4::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:14:8040020230306170312:522a0ee4", "product": { "name": "nodejs:14:8040020230306170312:522a0ee4", "product_id": "nodejs:14:8040020230306170312:522a0ee4", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@14:8040020230306170312:522a0ee4" } } }, { "category": "product_version", "name": "nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "product": { "name": "nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "product_id": "nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "product": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "product_id": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.4.0%2B18317%2B43f5ac16?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, "product_reference": "nodejs:14:8040020230306170312:522a0ee4", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch" }, "product_reference": "nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64 as a component of nodejs:14:8040020230306170312:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-4904", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2023-02-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168631" } ], "notes": [ { "category": "description", "text": "A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: buffer overflow in config_sortlist() due to missing string length check", "title": "Vulnerability summary" }, { "category": "other", "text": "The severity of this vulnerability is not important but moderate because exploiting the vulnerability can lead to a disruption of the availability of an application, yet doesn\u2019t compromise data integrity or confidentiality. The opportunity for disruption is further limited due to the requirement that an application allows an attacker to be able to input both untrusted and unvalidated data. Exploiting this flaw requires an application to use the library in such a way that would allow untrusted and unvalidated input to be passed directly to ares_set_sortlist by an attacker. In the event that this is able to occur, the impact to RHEL is limited to a crash of the application due to the protections offered by default in RHEL systems such as Stack Smashing Protection (SSP).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4904" }, { "category": "external", "summary": "RHBZ#2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4904", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4904" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904" }, { "category": "external", "summary": "https://github.com/c-ares/c-ares/issues/496", "url": "https://github.com/c-ares/c-ares/issues/496" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: buffer overflow in config_sortlist() due to missing string length check" }, { "cve": "CVE-2022-24999", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150323" } ], "notes": [ { "category": "description", "text": "A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "express: \"qs\" prototype poisoning causes the hang of the node process", "title": "Vulnerability summary" }, { "category": "other", "text": "- The qs and express Package is not used by the OpenShift Container Platform console directly and is only a third-party package dependency. Hence, it is marked as wontfix. \nAs a result, any services that depend on Openshift for their use of qs and express are marked won\u0027t fix. \n- In OpenShift Service Mesh, \u0027qs\u0027 is hoisted from storybook and node-sass, both are dev dependencies, and the vulnerability is not exposed to end users. Hence marked as wontfix.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24999" }, { "category": "external", "summary": "RHBZ#2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24999", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24999" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999" }, { "category": "external", "summary": "https://github.com/expressjs/express/releases/tag/4.17.3", "url": "https://github.com/expressjs/express/releases/tag/4.17.3" }, { "category": "external", "summary": "https://github.com/ljharb/qs/pull/428", "url": "https://github.com/ljharb/qs/pull/428" }, { "category": "external", "summary": "https://github.com/n8tz/CVE-2022-24999", "url": "https://github.com/n8tz/CVE-2022-24999" } ], "release_date": "2022-11-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "express: \"qs\" prototype poisoning causes the hang of the node process" }, { "cve": "CVE-2022-25881", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2165824" } ], "notes": [ { "category": "description", "text": "A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25881" }, { "category": "external", "summary": "RHBZ#2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability" }, { "acknowledgments": [ { "names": [ "VVX7" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2022-35256", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2022-09-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2130518" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-35256" }, { "category": "external", "summary": "RHBZ#2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-35256", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256", "url": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256" } ], "release_date": "2022-09-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields" }, { "cve": "CVE-2022-38900", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2023-02-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2170644" } ], "notes": [ { "category": "description", "text": "A flaw was found in decode-uri-component. This issue occurs due to a specially crafted input, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "decode-uri-component: improper input validation resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "For OpenShift Container Platform (OCP), Advanced Clusters Management for Kubernetes (ACM) and Advanced Cluster Security (ACS), the NPM decode-uri-component package is only present in source repositories as a development dependency, it is not used in production. Therefore this vulnerability is rated Low for OCP and ACS.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the decode-uri-component package. \nThe vulnerable code is not used, hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38900" }, { "category": "external", "summary": "RHBZ#2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38900", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38900" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900" }, { "category": "external", "summary": "https://github.com/SamVerschueren/decode-uri-component/issues/5", "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq" } ], "release_date": "2022-11-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "decode-uri-component: improper input validation resulting in DoS" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" }, { "cve": "CVE-2023-23918", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2171935" } ], "notes": [ { "category": "description", "text": "A privilege escalation vulnerability exists in Node.js \u003c19.6.1, \u003c18.14.1, \u003c16.19.1 and \u003c14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Permissions policies can be bypassed via process.mainModule", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23918" }, { "category": "external", "summary": "RHBZ#2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Permissions policies can be bypassed via process.mainModule" }, { "cve": "CVE-2023-23920", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172217" } ], "notes": [ { "category": "description", "text": "An untrusted search path vulnerability exists in Node.js. \u003c19.6.1, \u003c18.14.1, \u003c16.19.1, and \u003c14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23920" }, { "category": "external", "summary": "RHBZ#2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-30T13:06:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1533" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debuginfo-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-debugsource-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-docs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-full-i18n-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-nodemon-0:2.0.20-3.module+el8.4.0+18317+43f5ac16.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020230306170312:522a0ee4:npm-1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: insecure loading of ICU data through ICU_DATA environment variable" } ] }
rhsa-2022_9073
Vulnerability from csaf_redhat
Published
2022-12-15 16:20
Modified
2024-11-22 21:54
Summary
Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).
Security Fix(es):
* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
* minimist: prototype pollution (CVE-2021-44906)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [rhel-8] (BZ#2151625)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [rhel-8] (BZ#2151625)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:9073", "url": "https://access.redhat.com/errata/RHSA-2022:9073" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142806", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142806" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_9073.json" } ], "title": "Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T21:54:02+00:00", "generator": { "date": "2024-11-22T21:54:02+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2022:9073", "initial_release_date": "2022-12-15T16:20:58+00:00", "revision_history": [ { "date": "2022-12-15T16:20:58+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-12-15T16:20:58+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T21:54:02+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:16:8070020221207164159:bd1311ed", "product": { "name": "nodejs:16:8070020221207164159:bd1311ed", "product_id": "nodejs:16:8070020221207164159:bd1311ed", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@16:8070020221207164159:bd1311ed" } } }, { "category": "product_version", "name": "nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "product": { "name": "nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "product_id": "nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "product_id": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.module%2Bel8.7.0%2B17412%2Bbb0e4a6b?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product_id": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@25-1.module%2Bel8.5.0%2B10992%2Bfac5fe06?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "product": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "product_id": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "product": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "product_id": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.module%2Bel8.7.0%2B17412%2Bbb0e4a6b?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product_id": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@25-1.module%2Bel8.5.0%2B10992%2Bfac5fe06?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, "product_reference": "nodejs:16:8070020221207164159:bd1311ed", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src" }, "product_reference": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch" }, "product_reference": "nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch" }, "product_reference": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src" }, "product_reference": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" } ] }
rhsa-2023_0612
Vulnerability from csaf_redhat
Published
2023-02-06 19:42
Modified
2024-11-24 20:41
Summary
Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
Notes
Topic
An update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: rh-nodejs14-nodejs (14.21.1), rh-nodejs14-nodejs-nodemon (2.0.20). (BZ#2129806, BZ#2135519, BZ#2135520, BZ#2141022)
Security Fix(es):
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* minimist: prototype pollution (CVE-2021-44906)
* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* rh-nodejs14-nodejs: Provide full-i18n subpackage (BZ#2009880)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: rh-nodejs14-nodejs (14.21.1), rh-nodejs14-nodejs-nodemon (2.0.20). (BZ#2129806, BZ#2135519, BZ#2135520, BZ#2141022)\n\nSecurity Fix(es):\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* rh-nodejs14-nodejs: Provide full-i18n subpackage (BZ#2009880)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0612", "url": "https://access.redhat.com/errata/RHSA-2023:0612" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2009880", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2009880" }, { "category": "external", "summary": "2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2129806", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129806" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0612.json" } ], "title": "Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update", "tracking": { "current_release_date": "2024-11-24T20:41:46+00:00", "generator": { "date": "2024-11-24T20:41:46+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:0612", "initial_release_date": "2023-02-06T19:42:24+00:00", "revision_history": [ { "date": "2023-02-06T19:42:24+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-02-06T19:42:24+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:41:46+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for RHEL(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "product": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "product_id": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-nodemon@2.0.20-2.el7?arch=src" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "product": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "product_id": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.21.1-3.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "product": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "product_id": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-nodemon@2.0.20-2.el7?arch=noarch" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "product": { "name": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "product_id": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-docs@14.21.1-3.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "product_id": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.21.1-3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "product_id": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.21.1-3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "product_id": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-full-i18n@14.21.1-3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "product": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "product_id": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.17-14.21.1.3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.21.1-3.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "product_id": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.21.1-3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "product_id": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.21.1-3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "product_id": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-full-i18n@14.21.1-3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "product": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "product_id": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.17-14.21.1.3.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.21.1-3.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.21.1-3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.21.1-3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-full-i18n@14.21.1-3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "product": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "product_id": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.17-14.21.1.3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.21.1-3.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-0235", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2022-01-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2044591" } ], "notes": [ { "category": "description", "text": "A flaw was found in node-fetch. When following a redirect to a third-party domain, node-fetch was forwarding sensitive headers such as \"Authorization,\" \"WWW-Authenticate,\" and \"Cookie\" to potentially untrusted targets. This flaw leads to the exposure of sensitive information to an unauthorized actor.", "title": "Vulnerability description" }, { "category": "summary", "text": "node-fetch: exposure of sensitive information to an unauthorized actor", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw is out of support scope for dotnet-5.0. For more information about Dotnet product support scope, please see https://access.redhat.com/support/policy/updates/net-core", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-0235" }, { "category": "external", "summary": "RHBZ#2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-0235", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0235" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235" }, { "category": "external", "summary": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/", "url": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/" } ], "release_date": "2022-01-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "node-fetch: exposure of sensitive information to an unauthorized actor" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-24999", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150323" } ], "notes": [ { "category": "description", "text": "A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "express: \"qs\" prototype poisoning causes the hang of the node process", "title": "Vulnerability summary" }, { "category": "other", "text": "- The qs and express Package is not used by the OpenShift Container Platform console directly and is only a third-party package dependency. Hence, it is marked as wontfix. \nAs a result, any services that depend on Openshift for their use of qs and express are marked won\u0027t fix. \n- In OpenShift Service Mesh, \u0027qs\u0027 is hoisted from storybook and node-sass, both are dev dependencies, and the vulnerability is not exposed to end users. Hence marked as wontfix.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24999" }, { "category": "external", "summary": "RHBZ#2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24999", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24999" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999" }, { "category": "external", "summary": "https://github.com/expressjs/express/releases/tag/4.17.3", "url": "https://github.com/expressjs/express/releases/tag/4.17.3" }, { "category": "external", "summary": "https://github.com/ljharb/qs/pull/428", "url": "https://github.com/ljharb/qs/pull/428" }, { "category": "external", "summary": "https://github.com/n8tz/CVE-2022-24999", "url": "https://github.com/n8tz/CVE-2022-24999" } ], "release_date": "2022-11-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "express: \"qs\" prototype poisoning causes the hang of the node process" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-06T19:42:24+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0612" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" } ] }
rhsa-2023_1742
Vulnerability from csaf_redhat
Published
2023-04-12 15:04
Modified
2024-11-24 20:44
Summary
Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (14.21.3).
Security Fix(es):
* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
* minimist: prototype pollution (CVE-2021-44906)
* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
* express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)
* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.3).\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1742", "url": "https://access.redhat.com/errata/RHSA-2023:1742" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142822", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142822" }, { "category": "external", "summary": "2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "2175827", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2175827" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1742.json" } ], "title": "Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-24T20:44:11+00:00", "generator": { "date": "2024-11-24T20:44:11+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:1742", "initial_release_date": "2023-04-12T15:04:47+00:00", "revision_history": [ { "date": "2023-04-12T15:04:47+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-04-12T15:04:47+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:44:11+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.6::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:14:8060020230306170237:ad008a3a", "product": { "name": "nodejs:14:8060020230306170237:ad008a3a", "product_id": "nodejs:14:8060020230306170237:ad008a3a", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@14:8060020230306170237:ad008a3a" } } }, { "category": "product_version", "name": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "product": { "name": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "product_id": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, "product_reference": "nodejs:14:8060020230306170237:ad008a3a", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch" }, "product_reference": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-0235", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2022-01-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2044591" } ], "notes": [ { "category": "description", "text": "A flaw was found in node-fetch. When following a redirect to a third-party domain, node-fetch was forwarding sensitive headers such as \"Authorization,\" \"WWW-Authenticate,\" and \"Cookie\" to potentially untrusted targets. This flaw leads to the exposure of sensitive information to an unauthorized actor.", "title": "Vulnerability description" }, { "category": "summary", "text": "node-fetch: exposure of sensitive information to an unauthorized actor", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw is out of support scope for dotnet-5.0. For more information about Dotnet product support scope, please see https://access.redhat.com/support/policy/updates/net-core", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-0235" }, { "category": "external", "summary": "RHBZ#2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-0235", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0235" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235" }, { "category": "external", "summary": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/", "url": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/" } ], "release_date": "2022-01-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "node-fetch: exposure of sensitive information to an unauthorized actor" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-4904", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2023-02-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168631" } ], "notes": [ { "category": "description", "text": "A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: buffer overflow in config_sortlist() due to missing string length check", "title": "Vulnerability summary" }, { "category": "other", "text": "The severity of this vulnerability is not important but moderate because exploiting the vulnerability can lead to a disruption of the availability of an application, yet doesn\u2019t compromise data integrity or confidentiality. The opportunity for disruption is further limited due to the requirement that an application allows an attacker to be able to input both untrusted and unvalidated data. Exploiting this flaw requires an application to use the library in such a way that would allow untrusted and unvalidated input to be passed directly to ares_set_sortlist by an attacker. In the event that this is able to occur, the impact to RHEL is limited to a crash of the application due to the protections offered by default in RHEL systems such as Stack Smashing Protection (SSP).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4904" }, { "category": "external", "summary": "RHBZ#2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4904", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4904" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904" }, { "category": "external", "summary": "https://github.com/c-ares/c-ares/issues/496", "url": "https://github.com/c-ares/c-ares/issues/496" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: buffer overflow in config_sortlist() due to missing string length check" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" }, { "cve": "CVE-2022-24999", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150323" } ], "notes": [ { "category": "description", "text": "A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "express: \"qs\" prototype poisoning causes the hang of the node process", "title": "Vulnerability summary" }, { "category": "other", "text": "- The qs and express Package is not used by the OpenShift Container Platform console directly and is only a third-party package dependency. Hence, it is marked as wontfix. \nAs a result, any services that depend on Openshift for their use of qs and express are marked won\u0027t fix. \n- In OpenShift Service Mesh, \u0027qs\u0027 is hoisted from storybook and node-sass, both are dev dependencies, and the vulnerability is not exposed to end users. Hence marked as wontfix.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24999" }, { "category": "external", "summary": "RHBZ#2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24999", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24999" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999" }, { "category": "external", "summary": "https://github.com/expressjs/express/releases/tag/4.17.3", "url": "https://github.com/expressjs/express/releases/tag/4.17.3" }, { "category": "external", "summary": "https://github.com/ljharb/qs/pull/428", "url": "https://github.com/ljharb/qs/pull/428" }, { "category": "external", "summary": "https://github.com/n8tz/CVE-2022-24999", "url": "https://github.com/n8tz/CVE-2022-24999" } ], "release_date": "2022-11-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "express: \"qs\" prototype poisoning causes the hang of the node process" }, { "cve": "CVE-2022-25881", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2165824" } ], "notes": [ { "category": "description", "text": "A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25881" }, { "category": "external", "summary": "RHBZ#2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability" }, { "acknowledgments": [ { "names": [ "VVX7" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2022-35256", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2022-09-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2130518" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-35256" }, { "category": "external", "summary": "RHBZ#2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-35256", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256", "url": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256" } ], "release_date": "2022-09-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields" }, { "cve": "CVE-2022-38900", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2023-02-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2170644" } ], "notes": [ { "category": "description", "text": "A flaw was found in decode-uri-component. This issue occurs due to a specially crafted input, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "decode-uri-component: improper input validation resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "For OpenShift Container Platform (OCP), Advanced Clusters Management for Kubernetes (ACM) and Advanced Cluster Security (ACS), the NPM decode-uri-component package is only present in source repositories as a development dependency, it is not used in production. Therefore this vulnerability is rated Low for OCP and ACS.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the decode-uri-component package. \nThe vulnerable code is not used, hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38900" }, { "category": "external", "summary": "RHBZ#2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38900", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38900" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900" }, { "category": "external", "summary": "https://github.com/SamVerschueren/decode-uri-component/issues/5", "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq" } ], "release_date": "2022-11-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "decode-uri-component: improper input validation resulting in DoS" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" }, { "cve": "CVE-2023-23918", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2171935" } ], "notes": [ { "category": "description", "text": "A privilege escalation vulnerability exists in Node.js \u003c19.6.1, \u003c18.14.1, \u003c16.19.1 and \u003c14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Permissions policies can be bypassed via process.mainModule", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23918" }, { "category": "external", "summary": "RHBZ#2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Permissions policies can be bypassed via process.mainModule" }, { "cve": "CVE-2023-23920", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172217" } ], "notes": [ { "category": "description", "text": "An untrusted search path vulnerability exists in Node.js. \u003c19.6.1, \u003c18.14.1, \u003c16.19.1, and \u003c14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23920" }, { "category": "external", "summary": "RHBZ#2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: insecure loading of ICU data through ICU_DATA environment variable" } ] }
rhsa-2022_8832
Vulnerability from csaf_redhat
Published
2022-12-06 15:35
Modified
2024-11-22 21:44
Summary
Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (18.12.1). (BZ#2142809, BZ#2142830, BZ#2142834, BZ#2142856)
Security Fix(es):
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.12.1). (BZ#2142809, BZ#2142830, BZ#2142834, BZ#2142856)\n\nSecurity Fix(es):\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:8832", "url": "https://access.redhat.com/errata/RHSA-2022:8832" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142809" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8832.json" } ], "title": "Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T21:44:07+00:00", "generator": { "date": "2024-11-22T21:44:07+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2022:8832", "initial_release_date": "2022-12-06T15:35:44+00:00", "revision_history": [ { "date": "2022-12-06T15:35:44+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-12-06T15:35:44+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T21:44:07+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:18:9010020221118120946:rhel9", "product": { "name": "nodejs:18:9010020221118120946:rhel9", "product_id": "nodejs:18:9010020221118120946:rhel9", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@18:9010020221118120946:rhel9" } } }, { "category": "product_version", "name": "nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch", "product": { "name": "nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch", "product_id": "nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch", "product_id": "nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product": { "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product_id": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel9.1.0%2B15718%2Be52ec601?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product": { "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product_id": "nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-4.module%2Bel9.1.0%2B15718%2Be52ec601?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product": { "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product_id": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product": { "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product_id": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product": { "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product_id": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product": { "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product_id": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product": { "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product_id": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64", "product": { "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64", "product_id": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.18.12.1.1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src", "product": { "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src", "product_id": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src", "product": { "name": "nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src", "product_id": "nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "product": { "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "product_id": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel9.1.0%2B15718%2Be52ec601?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product": { "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_id": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product": { "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_id": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product": { "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_id": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product": { "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_id": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product": { "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_id": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le", "product": { "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_id": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.18.12.1.1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product": { "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product_id": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product": { "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product_id": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product": { "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product_id": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product": { "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product_id": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product": { "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product_id": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x", "product": { "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x", "product_id": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.18.12.1.1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product": { "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product_id": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product": { "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product_id": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product": { "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product_id": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product": { "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product_id": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product": { "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product_id": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@18.12.1-1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64", "product": { "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64", "product_id": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.18.12.1.1.module%2Bel9.1.0.z%2B17326%2B318294bb?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, "product_reference": "nodejs:18:9010020221118120946:rhel9", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64" }, "product_reference": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le" }, "product_reference": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x" }, "product_reference": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src" }, "product_reference": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64" }, "product_reference": "nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64" }, "product_reference": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le" }, "product_reference": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x" }, "product_reference": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64" }, "product_reference": "nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64" }, "product_reference": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le" }, "product_reference": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x" }, "product_reference": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64" }, "product_reference": "nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64" }, "product_reference": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le" }, "product_reference": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x" }, "product_reference": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64" }, "product_reference": "nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch" }, "product_reference": "nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64" }, "product_reference": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le" }, "product_reference": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x" }, "product_reference": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64" }, "product_reference": "nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch" }, "product_reference": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src" }, "product_reference": "nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch" }, "product_reference": "nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64" }, "product_reference": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le" }, "product_reference": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x" }, "product_reference": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64 as a component of nodejs:18:9010020221118120946:rhel9 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64" }, "product_reference": "npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64", "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-06T15:35:44+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:8832" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-06T15:35:44+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:8832" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debuginfo-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-debugsource-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-devel-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-docs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-full-i18n-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.x86_64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-nodemon-0:2.0.20-1.module+el9.1.0.z+17326+318294bb.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.aarch64", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.ppc64le", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.s390x", "AppStream-9.1.0.Z.MAIN:nodejs:18:9010020221118120946:rhel9:npm-1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" } ] }
rhsa-2023_0050
Vulnerability from csaf_redhat
Published
2023-01-09 14:55
Modified
2024-11-24 20:41
Summary
Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).
Security Fix(es):
* minimist: prototype pollution (CVE-2021-44906)
* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0050", "url": "https://access.redhat.com/errata/RHSA-2023:0050" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142821", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142821" }, { "category": "external", "summary": "2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0050.json" } ], "title": "Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-24T20:41:21+00:00", "generator": { "date": "2024-11-24T20:41:21+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:0050", "initial_release_date": "2023-01-09T14:55:37+00:00", "revision_history": [ { "date": "2023-01-09T14:55:37+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-01-09T14:55:37+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:41:21+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:14:8070020221212161539:bd1311ed", "product": { "name": "nodejs:14:8070020221212161539:bd1311ed", "product_id": "nodejs:14:8070020221212161539:bd1311ed", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@14:8070020221212161539:bd1311ed" } } }, { "category": "product_version", "name": "nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "product": { "name": "nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "product_id": "nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "product_id": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product": { "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product_id": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product": { "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product_id": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product": { "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product_id": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product": { "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product_id": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product": { "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product_id": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "product": { "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "product_id": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.17-1.14.21.1.2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "product": { "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "product_id": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "product": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "product_id": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product": { "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product_id": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product": { "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product_id": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product": { "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product_id": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product": { "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product_id": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product": { "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product_id": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "product": { "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "product_id": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.17-1.14.21.1.2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product": { "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product_id": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product": { "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product_id": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product": { "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product_id": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product": { "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product_id": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product": { "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product_id": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "product": { "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "product_id": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.17-1.14.21.1.2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product": { "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product_id": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product": { "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product_id": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product": { "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product_id": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product": { "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product_id": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product": { "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product_id": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.1-2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64", "product": { "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64", "product_id": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.17-1.14.21.1.2.module%2Bel8.7.0%2B17528%2Ba329cd47?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, "product_reference": "nodejs:14:8070020221212161539:bd1311ed", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64" }, "product_reference": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le" }, "product_reference": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x" }, "product_reference": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src" }, "product_reference": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64" }, "product_reference": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64" }, "product_reference": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le" }, "product_reference": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x" }, "product_reference": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64" }, "product_reference": "nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64" }, "product_reference": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le" }, "product_reference": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x" }, "product_reference": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64" }, "product_reference": "nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64" }, "product_reference": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le" }, "product_reference": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x" }, "product_reference": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64" }, "product_reference": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch" }, "product_reference": "nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64" }, "product_reference": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le" }, "product_reference": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x" }, "product_reference": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64" }, "product_reference": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64" }, "product_reference": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le" }, "product_reference": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x" }, "product_reference": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64 as a component of nodejs:14:8070020221212161539:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" }, "product_reference": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-09T14:55:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0050" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-0235", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2022-01-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2044591" } ], "notes": [ { "category": "description", "text": "A flaw was found in node-fetch. When following a redirect to a third-party domain, node-fetch was forwarding sensitive headers such as \"Authorization,\" \"WWW-Authenticate,\" and \"Cookie\" to potentially untrusted targets. This flaw leads to the exposure of sensitive information to an unauthorized actor.", "title": "Vulnerability description" }, { "category": "summary", "text": "node-fetch: exposure of sensitive information to an unauthorized actor", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw is out of support scope for dotnet-5.0. For more information about Dotnet product support scope, please see https://access.redhat.com/support/policy/updates/net-core", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-0235" }, { "category": "external", "summary": "RHBZ#2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-0235", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0235" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235" }, { "category": "external", "summary": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/", "url": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/" } ], "release_date": "2022-01-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-09T14:55:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0050" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "node-fetch: exposure of sensitive information to an unauthorized actor" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-09T14:55:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0050" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-24999", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150323" } ], "notes": [ { "category": "description", "text": "A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "express: \"qs\" prototype poisoning causes the hang of the node process", "title": "Vulnerability summary" }, { "category": "other", "text": "- The qs and express Package is not used by the OpenShift Container Platform console directly and is only a third-party package dependency. Hence, it is marked as wontfix. \nAs a result, any services that depend on Openshift for their use of qs and express are marked won\u0027t fix. \n- In OpenShift Service Mesh, \u0027qs\u0027 is hoisted from storybook and node-sass, both are dev dependencies, and the vulnerability is not exposed to end users. Hence marked as wontfix.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24999" }, { "category": "external", "summary": "RHBZ#2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24999", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24999" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999" }, { "category": "external", "summary": "https://github.com/expressjs/express/releases/tag/4.17.3", "url": "https://github.com/expressjs/express/releases/tag/4.17.3" }, { "category": "external", "summary": "https://github.com/ljharb/qs/pull/428", "url": "https://github.com/ljharb/qs/pull/428" }, { "category": "external", "summary": "https://github.com/n8tz/CVE-2022-24999", "url": "https://github.com/n8tz/CVE-2022-24999" } ], "release_date": "2022-11-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-09T14:55:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0050" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "express: \"qs\" prototype poisoning causes the hang of the node process" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-09T14:55:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0050" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debuginfo-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-debugsource-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221212161539:bd1311ed:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" } ] }
gsd-2022-43548
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2022-43548", "id": "GSD-2022-43548", "references": [ "https://advisories.mageia.org/CVE-2022-43548.html", "https://access.redhat.com/errata/RHSA-2022:8832", "https://access.redhat.com/errata/RHSA-2022:8833", "https://access.redhat.com/errata/RHSA-2022:9073", "https://access.redhat.com/errata/RHSA-2023:0050", "https://www.suse.com/security/cve/CVE-2022-43548.html", "https://www.debian.org/security/2023/dsa-5326", "https://access.redhat.com/errata/RHSA-2023:0321", "https://access.redhat.com/errata/RHSA-2023:0612" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-43548" ], "details": "A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.", "id": "GSD-2022-43548", "modified": "2023-12-13T01:19:31.799101Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "support@hackerone.com", "ID": "CVE-2022-43548", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "https://github.com/nodejs/node", "version": { "version_data": [ { "version_value": "Fixed in 19.0.1, 18.12.1, 16.18.1, 14.21.1" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "OS Command Injection (CWE-78)" } ] } ] }, "references": { "reference_data": [ { "name": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/", "refsource": "MISC", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/" }, { "name": "https://security.netapp.com/advisory/ntap-20230120-0004/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20230120-0004/" }, { "name": "DSA-5326", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2023/dsa-5326" }, { "name": "[debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html" }, { "name": "https://security.netapp.com/advisory/ntap-20230427-0007/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20230427-0007/" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe_name": [], "versionEndIncluding": "14.14.0", "versionStartIncluding": "14.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe_name": [], "versionEndIncluding": "16.12.0", "versionStartIncluding": "16.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:19.0.0:*:*:*:-:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "cpe_name": [], "versionEndExcluding": "16.18.1", "versionStartIncluding": "16.13.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "cpe_name": [], "versionEndExcluding": "14.21.1", "versionStartIncluding": "14.15.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe_name": [], "versionEndIncluding": "18.11.0", "versionStartIncluding": "18.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "support@hackerone.com", "ID": "CVE-2022-43548" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-78" } ] } ] }, "references": { "reference_data": [ { "name": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/", "refsource": "MISC", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/" }, { "name": "https://security.netapp.com/advisory/ntap-20230120-0004/", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://security.netapp.com/advisory/ntap-20230120-0004/" }, { "name": "DSA-5326", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2023/dsa-5326" }, { "name": "[debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html" }, { "name": "https://security.netapp.com/advisory/ntap-20230427-0007/", "refsource": "CONFIRM", "tags": [], "url": "https://security.netapp.com/advisory/ntap-20230427-0007/" } ] } }, "impact": { "baseMetricV3": { "cvssV3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 5.9 } }, "lastModifiedDate": "2023-04-27T15:15Z", "publishedDate": "2022-12-05T22:15Z" } } }
wid-sec-w-2023-1795
Vulnerability from csaf_certbund
Published
2023-07-18 22:00
Modified
2023-07-18 22:00
Summary
Oracle JD Edwards: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Die Komponenten der Oracle JDEdwards sind vollständig integrierte und komplette Lösungen geschäftlicher Anwendungen (ERP) für Unternehmen.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle JD Edwards ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Betroffene Betriebssysteme
- UNIX
- Linux
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Die Komponenten der Oracle JDEdwards sind vollst\u00e4ndig integrierte und komplette L\u00f6sungen gesch\u00e4ftlicher Anwendungen (ERP) f\u00fcr Unternehmen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle JD Edwards ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1795 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1795.json" }, { "category": "self", "summary": "WID-SEC-2023-1795 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1795" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - July 2023 - Appendix Oracle JD Edwards vom 2023-07-18", "url": "https://www.oracle.com/security-alerts/cpujul2023.html#AppendixJDE" } ], "source_lang": "en-US", "title": "Oracle JD Edwards: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-07-18T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:37:09.599+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1795", "initial_release_date": "2023-07-18T22:00:00.000+00:00", "revision_history": [ { "date": "2023-07-18T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle JD Edwards \u003c 9.2.7.4", "product": { "name": "Oracle JD Edwards \u003c 9.2.7.4", "product_id": "T028751", "product_identification_helper": { "cpe": "cpe:/a:oracle:jd_edwards_enterpriseone:9.2.7.4" } } }, { "category": "product_name", "name": "Oracle JD Edwards \u003c 9.2.7.3", "product": { "name": "Oracle JD Edwards \u003c 9.2.7.3", "product_id": "T028752", "product_identification_helper": { "cpe": "cpe:/a:oracle:jd_edwards_enterpriseone:9.2.7.3" } } } ], "category": "product_name", "name": "JD Edwards" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-22055", "notes": [ { "category": "description", "text": "In Oracle JD Edwards existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "release_date": "2023-07-18T22:00:00Z", "title": "CVE-2023-22055" }, { "cve": "CVE-2023-22050", "notes": [ { "category": "description", "text": "In Oracle JD Edwards existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "release_date": "2023-07-18T22:00:00Z", "title": "CVE-2023-22050" }, { "cve": "CVE-2022-43548", "notes": [ { "category": "description", "text": "In Oracle JD Edwards existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "release_date": "2023-07-18T22:00:00Z", "title": "CVE-2022-43548" }, { "cve": "CVE-2022-1471", "notes": [ { "category": "description", "text": "In Oracle JD Edwards existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "release_date": "2023-07-18T22:00:00Z", "title": "CVE-2022-1471" } ] }
wid-sec-w-2023-0561
Vulnerability from csaf_certbund
Published
2023-03-02 23:00
Modified
2023-05-18 22:00
Summary
Xerox FreeFlow Print Server: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
FreeFlow-Druckserver ist eine Druckserveranwendung für Xerox-Produktionsdrucker, die Flexibilität, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
Betroffene Betriebssysteme
- UNIX
- Linux
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "FreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0561 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0561.json" }, { "category": "self", "summary": "WID-SEC-2023-0561 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0561" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-007 vom 2023-05-18", "url": "https://security.business.xerox.com/wp-content/uploads/2023/05/Xerox-Security-Bulletin-XRX23-007-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-005 vom 2023-04-04", "url": "https://security.business.xerox.com/wp-content/uploads/2023/04/Xerox-Security-Bulletin-XRX23-005-Xerox%25C2%25AE-FreeFlow%25C2%25AE-Print-Server-v9.pdf" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-002 vom 2023-03-23", "url": "https://security.business.xerox.com/wp-content/uploads/2023/03/Xerox-Security-Bulletin-XRX23-002-FreeFlow-Print-Server-v2_Windows10.pdf" }, { "category": "external", "summary": "Xerox Mini Bulletin XRX21A vom 2023-03-02", "url": "https://security.business.xerox.com/wp-content/uploads/2023/03/Xerox-Security-Bulletin-XRX23-001-FreeFlow%C2%AE-Print-Server-v7.pdf" } ], "source_lang": "en-US", "title": "Xerox FreeFlow Print Server: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-05-18T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:17:56.928+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-0561", "initial_release_date": "2023-03-02T23:00:00.000+00:00", "revision_history": [ { "date": "2023-03-02T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-03-22T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von XEROX aufgenommen" }, { "date": "2023-04-03T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von XEROX aufgenommen" }, { "date": "2023-05-18T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von XEROX aufgenommen" } ], "status": "final", "version": "4" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Xerox FreeFlow Print Server 7", "product": { "name": "Xerox FreeFlow Print Server 7", "product_id": "T000872", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:7" } } }, { "category": "product_name", "name": "Xerox FreeFlow Print Server 9", "product": { "name": "Xerox FreeFlow Print Server 9", "product_id": "T002977", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:9" } } }, { "category": "product_name", "name": "Xerox FreeFlow Print Server v2", "product": { "name": "Xerox FreeFlow Print Server v2", "product_id": "T014888", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:v2" } } } ], "category": "product_name", "name": "FreeFlow Print Server" } ], "category": "vendor", "name": "Xerox" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-21900", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2023-21900" }, { "cve": "CVE-2023-21843", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2023-21843" }, { "cve": "CVE-2023-21835", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2023-21835" }, { "cve": "CVE-2023-21830", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2023-21830" }, { "cve": "CVE-2022-46882", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46882" }, { "cve": "CVE-2022-46881", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46881" }, { "cve": "CVE-2022-46880", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46880" }, { "cve": "CVE-2022-46878", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46878" }, { "cve": "CVE-2022-46875", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46875" }, { "cve": "CVE-2022-46874", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46874" }, { "cve": "CVE-2022-46872", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-46872" }, { "cve": "CVE-2022-45421", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45421" }, { "cve": "CVE-2022-45420", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45420" }, { "cve": "CVE-2022-45419", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45419" }, { "cve": "CVE-2022-45418", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45418" }, { "cve": "CVE-2022-45417", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45417" }, { "cve": "CVE-2022-45416", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45416" }, { "cve": "CVE-2022-45415", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45415" }, { "cve": "CVE-2022-45414", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45414" }, { "cve": "CVE-2022-45413", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45413" }, { "cve": "CVE-2022-45412", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45412" }, { "cve": "CVE-2022-45411", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45411" }, { "cve": "CVE-2022-45410", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45410" }, { "cve": "CVE-2022-45409", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45409" }, { "cve": "CVE-2022-45408", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45408" }, { "cve": "CVE-2022-45407", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45407" }, { "cve": "CVE-2022-45406", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45406" }, { "cve": "CVE-2022-45405", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45405" }, { "cve": "CVE-2022-45404", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45404" }, { "cve": "CVE-2022-45403", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45403" }, { "cve": "CVE-2022-45063", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45063" }, { "cve": "CVE-2022-45061", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-45061" }, { "cve": "CVE-2022-44638", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-44638" }, { "cve": "CVE-2022-43680", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-43680" }, { "cve": "CVE-2022-43548", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-43548" }, { "cve": "CVE-2022-42932", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-42932" }, { "cve": "CVE-2022-42929", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-42929" }, { "cve": "CVE-2022-42928", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-42928" }, { "cve": "CVE-2022-42927", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-42927" }, { "cve": "CVE-2022-42252", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-42252" }, { "cve": "CVE-2022-41556", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-41556" }, { "cve": "CVE-2022-41323", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-41323" }, { "cve": "CVE-2022-40962", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40962" }, { "cve": "CVE-2022-40960", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40960" }, { "cve": "CVE-2022-40959", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40959" }, { "cve": "CVE-2022-40958", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40958" }, { "cve": "CVE-2022-40957", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40957" }, { "cve": "CVE-2022-40956", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40956" }, { "cve": "CVE-2022-40674", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-40674" }, { "cve": "CVE-2022-3970", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3970" }, { "cve": "CVE-2022-39260", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-39260" }, { "cve": "CVE-2022-39253", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-39253" }, { "cve": "CVE-2022-3786", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3786" }, { "cve": "CVE-2022-37797", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-37797" }, { "cve": "CVE-2022-37454", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-37454" }, { "cve": "CVE-2022-37436", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-37436" }, { "cve": "CVE-2022-36760", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-36760" }, { "cve": "CVE-2022-3627", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3627" }, { "cve": "CVE-2022-3626", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3626" }, { "cve": "CVE-2022-36087", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-36087" }, { "cve": "CVE-2022-36059", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-36059" }, { "cve": "CVE-2022-3602", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3602" }, { "cve": "CVE-2022-3599", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3599" }, { "cve": "CVE-2022-3598", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3598" }, { "cve": "CVE-2022-3597", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3597" }, { "cve": "CVE-2022-3570", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3570" }, { "cve": "CVE-2022-35256", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-35256" }, { "cve": "CVE-2022-35255", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-35255" }, { "cve": "CVE-2022-34526", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-34526" }, { "cve": "CVE-2022-3276", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3276" }, { "cve": "CVE-2022-32222", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-32222" }, { "cve": "CVE-2022-32215", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-32215" }, { "cve": "CVE-2022-32213", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-32213" }, { "cve": "CVE-2022-32212", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-32212" }, { "cve": "CVE-2022-3204", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3204" }, { "cve": "CVE-2022-3190", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3190" }, { "cve": "CVE-2022-31630", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-31630" }, { "cve": "CVE-2022-31629", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-31629" }, { "cve": "CVE-2022-31628", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-31628" }, { "cve": "CVE-2022-3155", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3155" }, { "cve": "CVE-2022-3034", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3034" }, { "cve": "CVE-2022-3033", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3033" }, { "cve": "CVE-2022-3032", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-3032" }, { "cve": "CVE-2022-29458", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-29458" }, { "cve": "CVE-2022-29187", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-29187" }, { "cve": "CVE-2022-29154", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-29154" }, { "cve": "CVE-2022-2869", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2869" }, { "cve": "CVE-2022-2868", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2868" }, { "cve": "CVE-2022-2867", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2867" }, { "cve": "CVE-2022-27406", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-27406" }, { "cve": "CVE-2022-27405", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-27405" }, { "cve": "CVE-2022-27404", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-27404" }, { "cve": "CVE-2022-26981", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-26981" }, { "cve": "CVE-2022-24765", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-24765" }, { "cve": "CVE-2022-24070", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-24070" }, { "cve": "CVE-2022-23901", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-23901" }, { "cve": "CVE-2022-22844", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-22844" }, { "cve": "CVE-2022-2210", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2210" }, { "cve": "CVE-2022-2208", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2208" }, { "cve": "CVE-2022-2207", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2207" }, { "cve": "CVE-2022-2206", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2206" }, { "cve": "CVE-2022-2183", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2183" }, { "cve": "CVE-2022-2175", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2175" }, { "cve": "CVE-2022-21658", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-21658" }, { "cve": "CVE-2022-21628", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-21628" }, { "cve": "CVE-2022-21626", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-21626" }, { "cve": "CVE-2022-21624", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-21624" }, { "cve": "CVE-2022-21619", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-21619" }, { "cve": "CVE-2022-2125", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2125" }, { "cve": "CVE-2022-2122", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2122" }, { "cve": "CVE-2022-2058", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2058" }, { "cve": "CVE-2022-2057", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2057" }, { "cve": "CVE-2022-2056", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-2056" }, { "cve": "CVE-2022-1925", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1925" }, { "cve": "CVE-2022-1924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1924" }, { "cve": "CVE-2022-1923", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1923" }, { "cve": "CVE-2022-1922", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1922" }, { "cve": "CVE-2022-1921", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1921" }, { "cve": "CVE-2022-1920", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1920" }, { "cve": "CVE-2022-1348", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1348" }, { "cve": "CVE-2022-1056", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-1056" }, { "cve": "CVE-2022-0924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0924" }, { "cve": "CVE-2022-0909", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0909" }, { "cve": "CVE-2022-0908", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0908" }, { "cve": "CVE-2022-0907", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0907" }, { "cve": "CVE-2022-0891", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0891" }, { "cve": "CVE-2022-0865", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0865" }, { "cve": "CVE-2022-0562", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0562" }, { "cve": "CVE-2022-0561", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2022-0561" }, { "cve": "CVE-2021-46848", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-46848" }, { "cve": "CVE-2021-46823", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-46823" }, { "cve": "CVE-2021-42694", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-42694" }, { "cve": "CVE-2021-42574", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-42574" }, { "cve": "CVE-2021-37750", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-37750" }, { "cve": "CVE-2021-28544", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2021-28544" }, { "cve": "CVE-2020-10735", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2020-10735" }, { "cve": "CVE-2019-6111", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2019-6111" }, { "cve": "CVE-2018-7160", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2018-7160" }, { "cve": "CVE-2015-20107", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2015-20107" }, { "cve": "CVE-2006-20001", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T014888", "T000872", "T002977" ] }, "release_date": "2023-03-02T23:00:00Z", "title": "CVE-2006-20001" } ] }
wid-sec-w-2023-1033
Vulnerability from csaf_certbund
Published
2023-04-18 22:00
Modified
2024-05-01 22:00
Summary
Oracle MySQL: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
MySQL ist ein Open Source Datenbankserver von Oracle.
Angriff
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Betroffene Betriebssysteme
- Linux
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "MySQL ist ein Open Source Datenbankserver von Oracle.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1033 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1033.json" }, { "category": "self", "summary": "WID-SEC-2023-1033 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1033" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:1141 vom 2024-03-06", "url": "https://access.redhat.com/errata/RHSA-2024:1141" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - April 2023 - Appendix Oracle MySQL vom 2023-04-18", "url": "https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixMSQL" }, { "category": "external", "summary": "F5 Security Advisory K000134469 vom 2023-05-04", "url": "https://my.f5.com/manage/s/article/K000134469" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6060-2 vom 2023-05-08", "url": "https://ubuntu.com/security/notices/USN-6060-2" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6060-1 vom 2023-05-08", "url": "https://ubuntu.com/security/notices/USN-6060-1" }, { "category": "external", "summary": "Tenable Security Advisory TNS-2023-19 vom 2023-05-10", "url": "https://www.tenable.com/security/tns-2023-19" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:2621 vom 2023-05-09", "url": "https://access.redhat.com/errata/RHSA-2023:2621" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6060-3 vom 2023-05-15", "url": "https://ubuntu.com/security/notices/USN-6060-3" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3087 vom 2023-05-16", "url": "https://access.redhat.com/errata/RHSA-2023:3087" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:2241-1 vom 2023-05-18", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014924.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-2621 vom 2023-05-18", "url": "https://oss.oracle.com/pipermail/el-errata/2023-May/013976.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-3087 vom 2023-05-25", "url": "https://linux.oracle.com/errata/ELSA-2023-3087.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-1768 vom 2023-06-16", "url": "https://alas.aws.amazon.com/ALAS-2023-1768.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:2979-1 vom 2023-07-26", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-July/015640.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0894 vom 2024-02-20", "url": "https://access.redhat.com/errata/RHSA-2024:0894" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-1141 vom 2024-03-07", "url": "http://linux.oracle.com/errata/ELSA-2024-1141.html" }, { "category": "external", "summary": "IBM Security Bulletin 7038022 vom 2023-09-22", "url": "https://www.ibm.com/support/pages/node/7038022" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-0894 vom 2024-02-22", "url": "https://linux.oracle.com/errata/ELSA-2024-0894.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:2619 vom 2024-04-30", "url": "https://access.redhat.com/errata/RHSA-2024:2619" } ], "source_lang": "en-US", "title": "Oracle MySQL: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-01T22:00:00.000+00:00", "generator": { "date": "2024-05-02T08:40:44.738+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1033", "initial_release_date": "2023-04-18T22:00:00.000+00:00", "revision_history": [ { "date": "2023-04-18T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-05-04T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von F5 aufgenommen" }, { "date": "2023-05-08T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2023-05-09T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Tenable und Red Hat aufgenommen" }, { "date": "2023-05-15T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2023-05-16T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-05-18T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von SUSE und Oracle Linux aufgenommen" }, { "date": "2023-05-25T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2023-06-15T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-07-25T22:00:00.000+00:00", "number": "10", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-09-24T22:00:00.000+00:00", "number": "11", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-02-20T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-02-21T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-03-05T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-03-07T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-05-01T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "16" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP", "product": { "name": "F5 BIG-IP", "product_id": "T001663", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip:-" } } } ], "category": "vendor", "name": "F5" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "11.3", "product": { "name": "IBM Security Guardium 11.3", "product_id": "1048943", "product_identification_helper": { "cpe": "cpe:/a:ibm:security_guardium:11.3" } } }, { "category": "product_version", "name": "11.5", "product": { "name": "IBM Security Guardium 11.5", "product_id": "T026399", "product_identification_helper": { "cpe": "cpe:/a:ibm:security_guardium:11.5" } } } ], "category": "product_name", "name": "Security Guardium" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003c=5.7.41", "product": { "name": "Oracle MySQL \u003c=5.7.41", "product_id": "T027395", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql:5.7.41" } } }, { "category": "product_version_range", "name": "\u003c=8.0.33", "product": { "name": "Oracle MySQL \u003c=8.0.33", "product_id": "T027396", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql:8.0.33" } } } ], "category": "product_name", "name": "MySQL" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c6.2.1", "product": { "name": "Tenable Security Nessus Network Monitor \u003c6.2.1", "product_id": "T027665", "product_identification_helper": { "cpe": "cpe:/a:tenable:nessus_network_monitor:6.2.1" } } } ], "category": "product_name", "name": "Nessus Network Monitor" } ], "category": "vendor", "name": "Tenable Security" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-31160", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2022-31160" }, { "cve": "CVE-2022-37434", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2022-37434" }, { "cve": "CVE-2022-43548", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2022-43548" }, { "cve": "CVE-2022-43551", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2022-43551" }, { "cve": "CVE-2022-45143", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2022-45143" }, { "cve": "CVE-2023-0215", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-0215" }, { "cve": "CVE-2023-21911", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21911" }, { "cve": "CVE-2023-21912", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21912" }, { "cve": "CVE-2023-21913", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21913" }, { "cve": "CVE-2023-21917", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21917" }, { "cve": "CVE-2023-21919", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21919" }, { "cve": "CVE-2023-21920", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21920" }, { "cve": "CVE-2023-21929", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21929" }, { "cve": "CVE-2023-21933", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21933" }, { "cve": "CVE-2023-21935", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21935" }, { "cve": "CVE-2023-21940", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21940" }, { "cve": "CVE-2023-21945", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21945" }, { "cve": "CVE-2023-21946", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21946" }, { "cve": "CVE-2023-21947", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21947" }, { "cve": "CVE-2023-21953", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21953" }, { "cve": "CVE-2023-21955", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21955" }, { "cve": "CVE-2023-21962", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21962" }, { "cve": "CVE-2023-21963", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21963" }, { "cve": "CVE-2023-21966", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21966" }, { "cve": "CVE-2023-21971", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21971" }, { "cve": "CVE-2023-21972", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21972" }, { "cve": "CVE-2023-21976", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21976" }, { "cve": "CVE-2023-21977", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21977" }, { "cve": "CVE-2023-21980", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21980" }, { "cve": "CVE-2023-21982", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "1048943", "67646", "T000126", "T001663", "398363", "T027665", "T004914", "T026399" ], "last_affected": [ "T027395", "T027396" ] }, "release_date": "2023-04-18T22:00:00Z", "title": "CVE-2023-21982" } ] }
wid-sec-w-2023-0128
Vulnerability from csaf_certbund
Published
2023-01-17 23:00
Modified
2024-01-17 23:00
Summary
Oracle Java SE: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Betroffene Betriebssysteme
- UNIX
- Linux
- MacOS X
- Windows
- Sonstiges
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- MacOS X\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0128 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0128.json" }, { "category": "self", "summary": "WID-SEC-2023-0128 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0128" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle Java SE vom 2023-01-17", "url": "https://www.oracle.com/security-alerts/cpujan2023.html#AppendixJAVA" }, { "category": "external", "summary": "Change Log for Amazon Corretto 11", "url": "https://github.com/corretto/corretto-11/blob/release-11.0.18.10.1/CHANGELOG.md" }, { "category": "external", "summary": "Change Log for Amazon Corretto 8", "url": "https://github.com/corretto/corretto-8/blob/release-8.362.08.1/CHANGELOG.md" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0191 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0191" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0192 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0192" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0193 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0193" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0196 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0196" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0197 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0197" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0198 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0198" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0199 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0199" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0200 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0200" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0201 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0201" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0190 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0190" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0202 vom 2023-01-18", "url": "https://access.redhat.com/errata/RHSA-2023:0202" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-0192 vom 2023-01-19", "url": "http://linux.oracle.com/errata/ELSA-2023-0192.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-0200 vom 2023-01-19", "url": "http://linux.oracle.com/errata/ELSA-2023-0200.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-0202 vom 2023-01-19", "url": "http://linux.oracle.com/errata/ELSA-2023-0202.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0195 vom 2023-01-23", "url": "https://access.redhat.com/errata/RHSA-2023:0195" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-0194 vom 2023-01-23", "url": "https://linux.oracle.com/errata/ELSA-2023-0194.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALASCORRETTO8-2023-005 vom 2023-01-23", "url": "https://alas.aws.amazon.com/AL2/ALASCORRETTO8-2023-005.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-1919 vom 2023-01-23", "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1919.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-1918 vom 2023-01-23", "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1918.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0389 vom 2023-01-24", "url": "https://access.redhat.com/errata/RHSA-2023:0389" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0388 vom 2023-01-24", "url": "https://access.redhat.com/errata/RHSA-2023:0388" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0387 vom 2023-01-24", "url": "https://access.redhat.com/errata/RHSA-2023:0387" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0354 vom 2023-01-24", "url": "https://access.redhat.com/errata/RHSA-2023:0354" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0353 vom 2023-01-24", "url": "https://access.redhat.com/errata/RHSA-2023:0353" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0352 vom 2023-01-24", "url": "https://access.redhat.com/errata/RHSA-2023:0352" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0209 vom 2023-01-23", "url": "https://access.redhat.com/errata/RHSA-2023:0209" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0207 vom 2023-01-23", "url": "https://access.redhat.com/errata/RHSA-2023:0207" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0206 vom 2023-01-23", "url": "https://access.redhat.com/errata/RHSA-2023:0206" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0205 vom 2023-01-23", "url": "https://access.redhat.com/errata/RHSA-2023:0205" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0204 vom 2023-01-23", "url": "https://access.redhat.com/errata/RHSA-2023:0204" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0194 vom 2023-01-23", "url": "https://access.redhat.com/errata/RHSA-2023:0194" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0203 vom 2023-01-24", "url": "https://access.redhat.com/errata/RHSA-2023:0203" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-0203 vom 2023-01-24", "url": "http://linux.oracle.com/errata/ELSA-2023-0203.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-0195 vom 2023-01-24", "url": "http://linux.oracle.com/errata/ELSA-2023-0195.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-280 vom 2023-01-25", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2023-280.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-281 vom 2023-01-25", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2023-281.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-279 vom 2023-01-25", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2023-279.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-0208 vom 2023-01-27", "url": "https://linux.oracle.com/errata/ELSA-2023-0208.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0208 vom 2023-01-26", "url": "https://access.redhat.com/errata/RHSA-2023:0208" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0210 vom 2023-01-26", "url": "https://access.redhat.com/errata/RHSA-2023:0210" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-0210 vom 2023-01-27", "url": "http://linux.oracle.com/errata/ELSA-2023-0210.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5331 vom 2023-01-29", "url": "https://www.debian.org/security/2023/dsa-5331" }, { "category": "external", "summary": "CentOS Security Advisory CESA-2023:0203 vom 2023-01-30", "url": "https://lists.centos.org/pipermail/centos-announce/2023-January/086357.html" }, { "category": "external", "summary": "CentOS Security Advisory CESA-2023:0195 vom 2023-01-30", "url": "https://lists.centos.org/pipermail/centos-announce/2023-January/086356.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5335 vom 2023-02-01", "url": "https://lists.debian.org/debian-security-announce/2023/msg00024.html" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-104 vom 2023-02-07", "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-104/index.html" }, { "category": "external", "summary": "NetApp Security Advisory NTAP-20230208-0001 vom 2023-02-08", "url": "https://security.netapp.com/advisory/ntap-20230208-0001/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0437-1 vom 2023-02-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013805.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0436-1 vom 2023-02-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013804.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0435-1 vom 2023-02-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013803.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-1963 vom 2023-02-22", "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1963.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALASJAVA-OPENJDK11-2023-003 vom 2023-02-23", "url": "https://alas.aws.amazon.com/AL2/ALASJAVA-OPENJDK11-2023-003.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5898-1 vom 2023-02-28", "url": "https://ubuntu.com/security/notices/USN-5898-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5897-1 vom 2023-02-28", "url": "https://ubuntu.com/security/notices/USN-5897-1" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1047 vom 2023-03-02", "url": "https://access.redhat.com/errata/RHSA-2023:1047" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-1697 vom 2023-03-07", "url": "https://alas.aws.amazon.com/ALAS-2023-1697.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0685-1 vom 2023-03-13", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-March/014024.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0720-1 vom 2023-03-14", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-March/014035.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0752-1 vom 2023-03-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-March/014063.html" }, { "category": "external", "summary": "IBM Security Bulletin 6967213 vom 2023-03-30", "url": "https://www.ibm.com/support/pages/node/6967213" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:1850-1 vom 2023-04-14", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-April/014464.html" }, { "category": "external", "summary": "IBM Security Bulletin 6987835 vom 2023-05-02", "url": "https://www.ibm.com/support/pages/node/6987835" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:1823-1 vom 2023-05-04", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014730.html" }, { "category": "external", "summary": "IBM Security Bulletin 6995887 vom 2023-05-19", "url": "https://aix.software.ibm.com/aix/efixes/security/java_may2023_advisory.asc" }, { "category": "external", "summary": "IBM Security Bulletin 6999743 vom 2023-05-31", "url": "https://www.ibm.com/support/pages/node/6999743" }, { "category": "external", "summary": "IBM Security Bulletin 7007761 vom 2023-07-01", "url": "https://www.ibm.com/support/pages/node/7007761" }, { "category": "external", "summary": "Dell Security Advisory DSA-2023-085 vom 2023-07-21", "url": "https://www.dell.com/support/kbdoc/de-de/000210968/dsa-2023-085-dell-networker-runtime-environment-nre-security-update-for-java-se-embedded-vulnerabilities" }, { "category": "external", "summary": "IBM Security Bulletin 6983440 vom 2023-08-31", "url": "https://www.ibm.com/support/pages/node/6983440" }, { "category": "external", "summary": "IBM Security Bulletin 7058364 vom 2023-10-24", "url": "https://www.ibm.com/support/pages/node/7058364" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202401-25 vom 2024-01-17", "url": "https://security.gentoo.org/glsa/202401-25" } ], "source_lang": "en-US", "title": "Oracle Java SE: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-01-17T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:10:23.759+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-0128", "initial_release_date": "2023-01-17T23:00:00.000+00:00", "revision_history": [ { "date": "2023-01-17T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-01-18T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-01-19T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2023-01-22T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-01-23T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Oracle Linux, Amazon und Red Hat aufgenommen" }, { "date": "2023-01-24T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2023-01-26T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen" }, { "date": "2023-01-29T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Fedora, Oracle Linux und Debian aufgenommen" }, { "date": "2023-01-30T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von CentOS aufgenommen" }, { "date": "2023-02-01T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2023-02-06T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von HITACHI aufgenommen" }, { "date": "2023-02-08T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von NetApp aufgenommen" }, { "date": "2023-02-16T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-02-22T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-02-23T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-02-27T23:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2023-03-01T23:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-03-07T23:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-03-13T23:00:00.000+00:00", "number": "19", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-03-14T23:00:00.000+00:00", "number": "20", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-03-15T23:00:00.000+00:00", "number": "21", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-03-30T22:00:00.000+00:00", "number": "22", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-04-16T22:00:00.000+00:00", "number": "23", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-05-02T22:00:00.000+00:00", "number": "24", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-05-04T22:00:00.000+00:00", "number": "25", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-05-21T22:00:00.000+00:00", "number": "26", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-05-31T22:00:00.000+00:00", "number": "27", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-07-02T22:00:00.000+00:00", "number": "28", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-07-23T22:00:00.000+00:00", "number": "29", "summary": "Neue Updates von Dell aufgenommen" }, { "date": "2023-08-30T22:00:00.000+00:00", "number": "30", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-10-24T22:00:00.000+00:00", "number": "31", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-01-17T23:00:00.000+00:00", "number": "32", "summary": "Neue Updates von Gentoo aufgenommen" } ], "status": "final", "version": "32" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Corretto \u003c 8.362.08.1", "product": { "name": "Amazon Corretto \u003c 8.362.08.1", "product_id": "718391", "product_identification_helper": { "cpe": "cpe:/a:amazon:corretto:8" } } }, { "category": "product_name", "name": "Amazon Corretto \u003c 11.0.18.10.1", "product": { "name": "Amazon Corretto \u003c 11.0.18.10.1", "product_id": "T025936", "product_identification_helper": { "cpe": "cpe:/a:amazon:corretto:11.0.18.10.1" } } } ], "category": "product_name", "name": "Corretto" }, { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "Dell NetWorker \u003c 8.0.16", "product": { "name": "Dell NetWorker \u003c 8.0.16", "product_id": "T028846", "product_identification_helper": { "cpe": "cpe:/a:dell:networker:8.0.16" } } } ], "category": "vendor", "name": "Dell" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "Hitachi Command Suite", "product": { "name": "Hitachi Command Suite", "product_id": "T010951", "product_identification_helper": { "cpe": "cpe:/a:hitachi:command_suite:-" } } }, { "category": "product_name", "name": "Hitachi Configuration Manager", "product": { "name": "Hitachi Configuration Manager", "product_id": "T020304", "product_identification_helper": { "cpe": "cpe:/a:hitachi:configuration_manager:-" } } }, { "category": "product_name", "name": "Hitachi Ops Center", "product": { "name": "Hitachi Ops Center", "product_id": "T017562", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:-" } } } ], "category": "vendor", "name": "Hitachi" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "IBM AIX 7.2", "product": { "name": "IBM AIX 7.2", "product_id": "434967", "product_identification_helper": { "cpe": "cpe:/o:ibm:aix:7.2" } } }, { "category": "product_name", "name": "IBM AIX 7.3", "product": { "name": "IBM AIX 7.3", "product_id": "T021486", "product_identification_helper": { "cpe": "cpe:/o:ibm:aix:7.3" } } } ], "category": "product_name", "name": "AIX" }, { "category": "product_name", "name": "IBM Business Automation Workflow 19.0.0.3 - 22.0.2", "product": { "name": "IBM Business Automation Workflow 19.0.0.3 - 22.0.2", "product_id": "T027917", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:19.0.0.3-22.0.2" } } }, { "branches": [ { "category": "product_name", "name": "IBM FileNet Content Manager 5.5.4", "product": { "name": "IBM FileNet Content Manager 5.5.4", "product_id": "782758", "product_identification_helper": { "cpe": "cpe:/a:ibm:filenet_content_manager:5.5.4" } } }, { "category": "product_name", "name": "IBM FileNet Content Manager 5.5.8", "product": { "name": "IBM FileNet Content Manager 5.5.8", "product_id": "T024608", "product_identification_helper": { "cpe": "cpe:/a:ibm:filenet_content_manager:5.5.8" } } }, { "category": "product_name", "name": "IBM FileNet Content Manager 5.5.9", "product": { "name": "IBM FileNet Content Manager 5.5.9", "product_id": "T024609", "product_identification_helper": { "cpe": "cpe:/a:ibm:filenet_content_manager:5.5.9" } } } ], "category": "product_name", "name": "FileNet Content Manager" }, { "branches": [ { "category": "product_name", "name": "IBM Java \u003c 7.1.5.17", "product": { "name": "IBM Java \u003c 7.1.5.17", "product_id": "T027013", "product_identification_helper": { "cpe": "cpe:/a:ibm:jre:7.1.5.17" } } }, { "category": "product_name", "name": "IBM Java \u003c 8.0.8.0", "product": { "name": "IBM Java \u003c 8.0.8.0", "product_id": "T027014", "product_identification_helper": { "cpe": "cpe:/a:ibm:jre:8.0.8.0" } } } ], "category": "product_name", "name": "Java" }, { "category": "product_name", "name": "IBM Maximo Asset Management 7.6.1", "product": { "name": "IBM Maximo Asset Management 7.6.1", "product_id": "389168", "product_identification_helper": { "cpe": "cpe:/a:ibm:maximo_asset_management:7.6.1" } } }, { "branches": [ { "category": "product_name", "name": "IBM TXSeries 9.1", "product": { "name": "IBM TXSeries 9.1", "product_id": "T015903", "product_identification_helper": { "cpe": "cpe:/a:ibm:txseries:for_multiplatforms_9.1" } } }, { "category": "product_name", "name": "IBM TXSeries 8.2", "product": { "name": "IBM TXSeries 8.2", "product_id": "T015904", "product_identification_helper": { "cpe": "cpe:/a:ibm:txseries:for_multiplatforms_8.2" } } }, { "category": "product_name", "name": "IBM TXSeries 8.1", "product": { "name": "IBM TXSeries 8.1", "product_id": "T015905", "product_identification_helper": { "cpe": "cpe:/a:ibm:txseries:for_multiplatforms_8.1" } } } ], "category": "product_name", "name": "TXSeries" }, { "category": "product_name", "name": "IBM Tivoli Netcool/OMNIbus \u003c 8.1.0.31", "product": { "name": "IBM Tivoli Netcool/OMNIbus \u003c 8.1.0.31", "product_id": "T030747", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_netcool%2fomnibus:8.1.0.31" } } }, { "category": "product_name", "name": "IBM VIOS 3.1", "product": { "name": "IBM VIOS 3.1", "product_id": "1039165", "product_identification_helper": { "cpe": "cpe:/a:ibm:vios:3.1" } } } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "NetApp ActiveIQ Unified Manager", "product": { "name": "NetApp ActiveIQ Unified Manager", "product_id": "T016960", "product_identification_helper": { "cpe": "cpe:/a:netapp:active_iq_unified_manager:-" } } } ], "category": "vendor", "name": "NetApp" }, { "branches": [ { "category": "product_name", "name": "Open Source CentOS", "product": { "name": "Open Source CentOS", "product_id": "1727", "product_identification_helper": { "cpe": "cpe:/o:centos:centos:-" } } }, { "category": "product_name", "name": "Open Source OpenJDK", "product": { "name": "Open Source OpenJDK", "product_id": "580789", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:-" } } } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle GraalVM Enterprise Edition 20.3.8", "product": { "name": "Oracle GraalVM Enterprise Edition 20.3.8", "product_id": "T025929", "product_identification_helper": { "cpe": "cpe:/a:oracle:graalvm:20.3.8::enterprise" } } }, { "branches": [ { "category": "product_name", "name": "Oracle Java SE 21.3.4", "product": { "name": "Oracle Java SE 21.3.4", "product_id": "T025881", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:21.3.4" } } }, { "category": "product_name", "name": "Oracle Java SE 22.3.0", "product": { "name": "Oracle Java SE 22.3.0", "product_id": "T025882", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:22.3.0" } } }, { "category": "product_name", "name": "Oracle Java SE 17.0.5", "product": { "name": "Oracle Java SE 17.0.5", "product_id": "T025883", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:17.0.5" } } }, { "category": "product_name", "name": "Oracle Java SE 11.0.17", "product": { "name": "Oracle Java SE 11.0.17", "product_id": "T025884", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:11.0.17" } } }, { "category": "product_name", "name": "Oracle Java SE 19.0.1", "product": { "name": "Oracle Java SE 19.0.1", "product_id": "T025930", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:19.0.1" } } }, { "category": "product_name", "name": "Oracle Java SE 8u351", "product": { "name": "Oracle Java SE 8u351", "product_id": "T025931", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:8u351" } } } ], "category": "product_name", "name": "Java SE" }, { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-43548", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle Java SE existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T010951", "389168", "718391", "T004914", "T025929", "782758", "T025936", "T027917", "T025931", "T020304", "T028846", "398363", "T025930", "T027014", "T027013", "434967", "1039165", "T012167", "T024609", "T016960", "T024608", "T017562", "2951", "T002207", "T000126", "580789", "T025884", "T030747", "T025883", "1727", "T021486", "T025882", "T025881" ] }, "release_date": "2023-01-17T23:00:00Z", "title": "CVE-2022-43548" }, { "cve": "CVE-2023-21830", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle Java SE existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T010951", "389168", "718391", "T004914", "T025929", "782758", "T025936", "T027917", "T025931", "T020304", "T028846", "398363", "T025930", "T027014", "T027013", "434967", "1039165", "T012167", "T024609", "T016960", "T024608", "T017562", "2951", "T002207", "T000126", "580789", "T025884", "T030747", "T025883", "1727", "T021486", "T025882", "T025881" ] }, "release_date": "2023-01-17T23:00:00Z", "title": "CVE-2023-21830" }, { "cve": "CVE-2023-21835", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle Java SE existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T010951", "389168", "718391", "T004914", "T025929", "782758", "T025936", "T027917", "T025931", "T020304", "T028846", "398363", "T025930", "T027014", "T027013", "434967", "1039165", "T012167", "T024609", "T016960", "T024608", "T017562", "2951", "T002207", "T000126", "580789", "T025884", "T030747", "T025883", "1727", "T021486", "T025882", "T025881" ] }, "release_date": "2023-01-17T23:00:00Z", "title": "CVE-2023-21835" }, { "cve": "CVE-2023-21843", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle Java SE existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T010951", "389168", "718391", "T004914", "T025929", "782758", "T025936", "T027917", "T025931", "T020304", "T028846", "398363", "T025930", "T027014", "T027013", "434967", "1039165", "T012167", "T024609", "T016960", "T024608", "T017562", "2951", "T002207", "T000126", "580789", "T025884", "T030747", "T025883", "1727", "T021486", "T025882", "T025881" ] }, "release_date": "2023-01-17T23:00:00Z", "title": "CVE-2023-21843" } ] }
wid-sec-w-2022-1960
Vulnerability from csaf_certbund
Published
2022-11-06 23:00
Modified
2024-05-09 22:00
Summary
Node.js: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
Betroffene Betriebssysteme
- Linux
- Sonstiges
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-1960 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1960.json" }, { "category": "self", "summary": "WID-SEC-2022-1960 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1960" }, { "category": "external", "summary": "Node v14.21.1 (LTS) vom 2022-11-04", "url": "https://nodejs.org/en/blog/release/v14.21.1/" }, { "category": "external", "summary": "Node v16.18.1 (LTS) vom 2022-11-04", "url": "https://nodejs.org/en/blog/release/v16.18.1/" }, { "category": "external", "summary": "Node v18.12.1 (LTS) vom 2022-11-04", "url": "https://nodejs.org/en/blog/release/v18.12.1/" }, { "category": "external", "summary": "Node v19.0.1 (Current) vom 2022-11-04", "url": "https://nodejs.org/en/blog/release/v19.0.1/" }, { "category": "external", "summary": "node.js Security Releases vom 2022-11-06", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:3968-1 vom 2022-11-14", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012911.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:3967-1 vom 2022-11-14", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012912.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:3989-1 vom 2022-11-15", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012924.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:4003-1 vom 2022-11-15", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012938.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:4084-1 vom 2022-11-18", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013001.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:4255-1 vom 2022-11-28", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013130.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:4254-1 vom 2022-11-28", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013127.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:4301-1 vom 2022-12-01", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-December/013181.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:8832 vom 2022-12-06", "url": "https://access.redhat.com/errata/RHSA-2022:8832" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:8833 vom 2022-12-06", "url": "https://access.redhat.com/errata/RHSA-2022:8833" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-8833 vom 2022-12-08", "url": "http://linux.oracle.com/errata/ELSA-2022-8833.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-8832 vom 2022-12-09", "url": "https://linux.oracle.com/errata/ELSA-2022-8832.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:9073 vom 2022-12-15", "url": "https://access.redhat.com/errata/RHSA-2022:9073" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-9073 vom 2022-12-17", "url": "http://linux.oracle.com/errata/ELSA-2022-9073-1.html" }, { "category": "external", "summary": "IBM Security Bulletin 6849223 vom 2023-01-06", "url": "https://www.ibm.com/support/pages/node/6849223" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-0050 vom 2023-01-10", "url": "http://linux.oracle.com/errata/ELSA-2023-0050.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0050 vom 2023-01-09", "url": "https://access.redhat.com/errata/RHSA-2023:0050" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-0321 vom 2023-01-24", "url": "https://linux.oracle.com/errata/ELSA-2023-0321.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0321 vom 2023-01-23", "url": "https://access.redhat.com/errata/RHSA-2023:0321" }, { "category": "external", "summary": "Debian Security Advisory DSA-5326 vom 2023-01-24", "url": "https://lists.debian.org/debian-security-announce/2023/msg00015.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0612 vom 2023-02-06", "url": "https://access.redhat.com/errata/RHSA-2023:0612" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0408-1 vom 2023-02-14", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013759.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0419-1 vom 2023-02-15", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013766.html" }, { "category": "external", "summary": "Debian Security Advisory DLA-3344 vom 2023-02-26", "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html" }, { "category": "external", "summary": "IBM Security Bulletin 6959033 vom 2023-03-01", "url": "https://www.ibm.com/support/pages/node/6959033" }, { "category": "external", "summary": "IBM Security Bulletin 6965816 vom 2023-03-24", "url": "https://www.ibm.com/support/pages/node/6965816" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1533 vom 2023-04-01", "url": "https://access.redhat.com/errata/RHSA-2023:1533" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1742 vom 2023-04-12", "url": "https://access.redhat.com/errata/RHSA-2023:1742" }, { "category": "external", "summary": "IBM Security Bulletin 6984185 vom 2023-04-17", "url": "https://www.ibm.com/support/pages/node/6984185" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2024-106 vom 2024-01-30", "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-106/index.html" }, { "category": "external", "summary": "IBM Security Bulletin 7008449 vom 2023-06-29", "url": "https://www.ibm.com/support/pages/node/7008449" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-286 vom 2024-01-23", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2023-286.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6491-1 vom 2023-11-21", "url": "https://ubuntu.com/security/notices/USN-6491-1" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202405-29 vom 2024-05-08", "url": "https://security.gentoo.org/glsa/202405-29" } ], "source_lang": "en-US", "title": "Node.js: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen", "tracking": { "current_release_date": "2024-05-09T22:00:00.000+00:00", "generator": { "date": "2024-05-10T09:04:12.644+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-1960", "initial_release_date": "2022-11-06T23:00:00.000+00:00", "revision_history": [ { "date": "2022-11-06T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-11-14T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-11-15T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-11-20T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-11-28T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-12-01T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-12-06T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-12-07T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2022-12-08T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2022-12-15T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-12-18T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2023-01-08T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von IBM und IBM-APAR aufgenommen" }, { "date": "2023-01-09T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen" }, { "date": "2023-01-23T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen" }, { "date": "2023-01-24T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2023-02-06T23:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-02-14T23:00:00.000+00:00", "number": "17", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-02-15T23:00:00.000+00:00", "number": "18", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-02-26T23:00:00.000+00:00", "number": "19", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2023-02-28T23:00:00.000+00:00", "number": "20", "summary": "Neue Updates von IBM und IBM-APAR aufgenommen" }, { "date": "2023-03-23T23:00:00.000+00:00", "number": "21", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-04-02T22:00:00.000+00:00", "number": "22", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-04-12T22:00:00.000+00:00", "number": "23", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-04-17T22:00:00.000+00:00", "number": "24", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-06-29T22:00:00.000+00:00", "number": "25", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-11-20T23:00:00.000+00:00", "number": "26", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-01-22T23:00:00.000+00:00", "number": "27", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2024-01-29T23:00:00.000+00:00", "number": "28", "summary": "Neue Updates von HITACHI aufgenommen" }, { "date": "2024-05-09T22:00:00.000+00:00", "number": "29", "summary": "Neue Updates von Gentoo aufgenommen" } ], "status": "final", "version": "29" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "Hitachi Ops Center", "product": { "name": "Hitachi Ops Center", "product_id": "T017562", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:-" } } } ], "category": "vendor", "name": "Hitachi" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "21.0.2", "product": { "name": "IBM Business Automation Workflow 21.0.2", "product_id": "1055431", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:21.0.2" } } }, { "category": "product_version", "name": "21.0.3", "product": { "name": "IBM Business Automation Workflow 21.0.3", "product_id": "1150328", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:21.0.3" } } }, { "category": "product_version", "name": "22.0.1", "product": { "name": "IBM Business Automation Workflow 22.0.1", "product_id": "1268578", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:22.0.1" } } }, { "category": "product_version", "name": "18.0.0.0", "product": { "name": "IBM Business Automation Workflow 18.0.0.0", "product_id": "389078", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:18.0.0.0" } } }, { "category": "product_version", "name": "18.0.0.1", "product": { "name": "IBM Business Automation Workflow 18.0.0.1", "product_id": "389079", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:18.0.0.1" } } }, { "category": "product_version", "name": "18.0.0.2", "product": { "name": "IBM Business Automation Workflow 18.0.0.2", "product_id": "428468", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:18.0.0.2" } } }, { "category": "product_version", "name": "19.0.0.1", "product": { "name": "IBM Business Automation Workflow 19.0.0.1", "product_id": "433292", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:19.0.0.1" } } }, { "category": "product_version", "name": "19.0.0.2", "product": { "name": "IBM Business Automation Workflow 19.0.0.2", "product_id": "672243", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:19.0.0.2" } } }, { "category": "product_version", "name": "19.0.0.3", "product": { "name": "IBM Business Automation Workflow 19.0.0.3", "product_id": "672244", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:19.0.0.3" } } }, { "category": "product_version", "name": "20.0.0.1", "product": { "name": "IBM Business Automation Workflow 20.0.0.1", "product_id": "867559", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:20.0.0.1" } } }, { "category": "product_version", "name": "20.0.0.2", "product": { "name": "IBM Business Automation Workflow 20.0.0.2", "product_id": "867560", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:20.0.0.2" } } }, { "category": "product_version", "name": "21.0.3.1", "product": { "name": "IBM Business Automation Workflow 21.0.3.1", "product_id": "T025512", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:21.0.3.1" } } }, { "category": "product_version", "name": "22.0.2", "product": { "name": "IBM Business Automation Workflow 22.0.2", "product_id": "T025770", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:22.0.2" } } } ], "category": "product_name", "name": "Business Automation Workflow" }, { "branches": [ { "category": "product_name", "name": "IBM DB2", "product": { "name": "IBM DB2", "product_id": "5104", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:-" } } }, { "category": "product_version", "name": "11.5.8.0", "product": { "name": "IBM DB2 11.5.8.0", "product_id": "T027299", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:11.5.8.0" } } } ], "category": "product_name", "name": "DB2" }, { "category": "product_name", "name": "IBM Integration Bus", "product": { "name": "IBM Integration Bus", "product_id": "T011169", "product_identification_helper": { "cpe": "cpe:/a:ibm:integration_bus:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003c10.1.14", "product": { "name": "IBM Spectrum Protect \u003c10.1.14", "product_id": "T026783", "product_identification_helper": { "cpe": "cpe:/a:ibm:spectrum_protect:10.1.14" } } } ], "category": "product_name", "name": "Spectrum Protect" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c14.21.1", "product": { "name": "Open Source Node.js \u003c14.21.1", "product_id": "T025226", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:14.21.1" } } }, { "category": "product_version_range", "name": "\u003c16.18.1", "product": { "name": "Open Source Node.js \u003c16.18.1", "product_id": "T025228", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:16.18.1" } } }, { "category": "product_version_range", "name": "\u003c18.12.1", "product": { "name": "Open Source Node.js \u003c18.12.1", "product_id": "T025229", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:18.12.1" } } }, { "category": "product_version_range", "name": "\u003c19.0.1", "product": { "name": "Open Source Node.js \u003c19.0.1", "product_id": "T025230", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:19.0.1" } } } ], "category": "product_name", "name": "Node.js" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-43548", "notes": [ { "category": "description", "text": "In Node.js besteht eine Schwachstelle. Der DNS-Rebinding-Protector f\u00fcr \"--inspect\" erlaubt ung\u00fcltige IP-Adressen im Oktalformat. Ein Angreifer kann dies f\u00fcr einen DNS-Rebinding-Angriff ausnutzen, um Sicherheitsmechanismen zu umgehen und weitere Angriffe durchzuf\u00fchren. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "672243", "67646", "T011169", "672244", "T004914", "1055431", "433292", "398363", "T025512", "T025770", "T026783", "T027299", "867559", "1268578", "389079", "428468", "T012167", "389078", "1150328", "T017562", "2951", "T002207", "867560", "T000126", "5104" ] }, "release_date": "2022-11-06T23:00:00Z", "title": "CVE-2022-43548" } ] }
ghsa-r934-m2c7-26gh
Vulnerability from github
Published
2022-12-06 00:30
Modified
2023-01-20 21:30
Severity ?
Details
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
{ "affected": [], "aliases": [ "CVE-2022-43548" ], "database_specific": { "cwe_ids": [ "CWE-78" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2022-12-05T22:15:00Z", "severity": "HIGH" }, "details": "A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.", "id": "GHSA-r934-m2c7-26gh", "modified": "2023-01-20T21:30:31Z", "published": "2022-12-06T00:30:16Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html" }, { "type": "WEB", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20230120-0004" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20230427-0007" }, { "type": "WEB", "url": "https://www.debian.org/security/2023/dsa-5326" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.