csaf_redhat - RHSA-2023:5361

RHSA-2023:5361

Vulnerability from csaf_redhat

Published

2023-09-26 14:56

Modified

2025-03-20 17:23

Summary

Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Notes

Topic

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (16). (BZ#2223679, BZ#2223681, BZ#2223683, BZ#2223685, BZ#2223687, BZ#2233892) Security Fix(es): * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002) * nodejs-semver: Regular expression denial of service (CVE-2022-25883) * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581) * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588) * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589) * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590) * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006) * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * nodejs:16/nodejs: nodejs.prov doesn't generate the bundled dependency for modules starting @ like @colors/colors (BZ#2237395)

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16). (BZ#2223679, BZ#2223681, BZ#2223683, BZ#2223685, BZ#2223687, BZ#2233892)\n\nSecurity Fix(es):\n\n* nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)\n\n* nodejs-semver: Regular expression denial of service (CVE-2022-25883)\n\n* nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)\n\n* nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)\n\n* nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)\n\n* nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)\n\n* nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006)\n\n* nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: nodejs.prov doesn't generate the bundled dependency for modules starting @ like @colors/colors (BZ#2237395)",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2023:5361",
            url: "https://access.redhat.com/errata/RHSA-2023:5361",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "2216475",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2216475",
         },
         {
            category: "external",
            summary: "2219824",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2219824",
         },
         {
            category: "external",
            summary: "2219838",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2219838",
         },
         {
            category: "external",
            summary: "2219841",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2219841",
         },
         {
            category: "external",
            summary: "2219842",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2219842",
         },
         {
            category: "external",
            summary: "2223679",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2223679",
         },
         {
            category: "external",
            summary: "2230948",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230948",
         },
         {
            category: "external",
            summary: "2230955",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230955",
         },
         {
            category: "external",
            summary: "2230956",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230956",
         },
         {
            category: "external",
            summary: "2233892",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2233892",
         },
         {
            category: "external",
            summary: "2237395",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2237395",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5361.json",
         },
      ],
      title: "Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update",
      tracking: {
         current_release_date: "2025-03-20T17:23:26+00:00",
         generator: {
            date: "2025-03-20T17:23:26+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.1",
            },
         },
         id: "RHSA-2023:5361",
         initial_release_date: "2023-09-26T14:56:14+00:00",
         revision_history: [
            {
               date: "2023-09-26T14:56:14+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2023-09-26T14:56:14+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-03-20T17:23:26+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux AppStream EUS (v.8.6)",
                        product: {
                           name: "Red Hat Enterprise Linux AppStream EUS (v.8.6)",
                           product_id: "AppStream-8.6.0.Z.EUS",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:rhel_eus:8.6::appstream",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Enterprise Linux",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs:16:8060020230906023909:ad008a3a",
                        product: {
                           name: "nodejs:16:8060020230906023909:ad008a3a",
                           product_id: "nodejs:16:8060020230906023909:ad008a3a",
                           product_identification_helper: {
                              purl: "pkg:rpmmod/redhat/nodejs@16:8060020230906023909:ad008a3a",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                        product: {
                           name: "nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                           product_id: "nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-docs@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=noarch&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                        product: {
                           name: "nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                           product_id: "nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel8.6.0%2B19765%2B366b9144?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                        product: {
                           name: "nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                           product_id: "nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-packaging@26-1.module%2Bel8.6.0%2B19856%2Bc0c87259?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                        product: {
                           name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                           product_id: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=aarch64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                        product: {
                           name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                           product_id: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debuginfo@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=aarch64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                        product: {
                           name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                           product_id: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debugsource@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=aarch64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                        product: {
                           name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                           product_id: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-devel@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=aarch64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                        product: {
                           name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                           product_id: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-full-i18n@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=aarch64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                        product: {
                           name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                           product_id: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/npm@8.19.4-1.16.20.2.2.module%2Bel8.6.0%2B19897%2B9590a839?arch=aarch64&epoch=1",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                        product: {
                           name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                           product_id: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=src&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                        product: {
                           name: "nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                           product_id: "nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel8.6.0%2B19765%2B366b9144?arch=src",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                        product: {
                           name: "nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                           product_id: "nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-packaging@26-1.module%2Bel8.6.0%2B19856%2Bc0c87259?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                        product: {
                           name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_id: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                        product: {
                           name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_id: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debuginfo@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                        product: {
                           name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_id: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debugsource@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                        product: {
                           name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_id: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-devel@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                        product: {
                           name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_id: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-full-i18n@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                        product: {
                           name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_id: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/npm@8.19.4-1.16.20.2.2.module%2Bel8.6.0%2B19897%2B9590a839?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                        product: {
                           name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                           product_id: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=s390x&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                        product: {
                           name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                           product_id: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debuginfo@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=s390x&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                        product: {
                           name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                           product_id: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debugsource@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=s390x&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                        product: {
                           name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                           product_id: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-devel@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=s390x&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                        product: {
                           name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                           product_id: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-full-i18n@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=s390x&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                        product: {
                           name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                           product_id: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/npm@8.19.4-1.16.20.2.2.module%2Bel8.6.0%2B19897%2B9590a839?arch=s390x&epoch=1",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                        product: {
                           name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                           product_id: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=x86_64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                        product: {
                           name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                           product_id: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debuginfo@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=x86_64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                        product: {
                           name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                           product_id: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debugsource@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=x86_64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                        product: {
                           name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                           product_id: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-devel@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=x86_64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                        product: {
                           name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                           product_id: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-full-i18n@16.20.2-2.module%2Bel8.6.0%2B19897%2B9590a839?arch=x86_64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
                        product: {
                           name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
                           product_id: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/npm@8.19.4-1.16.20.2.2.module%2Bel8.6.0%2B19897%2B9590a839?arch=x86_64&epoch=1",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
            },
            product_reference: "nodejs:16:8060020230906023909:ad008a3a",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
            },
            product_reference: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
            },
            product_reference: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
            },
            product_reference: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
            },
            product_reference: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
            },
            product_reference: "nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
            },
            product_reference: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
            },
            product_reference: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
            },
            product_reference: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
            },
            product_reference: "nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
            },
            product_reference: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
            },
            product_reference: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
            },
            product_reference: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
            },
            product_reference: "nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
            },
            product_reference: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
            },
            product_reference: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
            },
            product_reference: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
            },
            product_reference: "nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
            },
            product_reference: "nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
            },
            product_reference: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
            },
            product_reference: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
            },
            product_reference: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
            },
            product_reference: "nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
            },
            product_reference: "nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
            },
            product_reference: "nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
            },
            product_reference: "nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
            },
            product_reference: "nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
            },
            product_reference: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
            },
            product_reference: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
            },
            product_reference: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64 as a component of nodejs:16:8060020230906023909:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
               product_id: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
            },
            product_reference: "npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
            relates_to_product_reference: "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2022-25883",
         cwe: {
            id: "CWE-1333",
            name: "Inefficient Regular Expression Complexity",
         },
         discovery_date: "2023-06-21T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2216475",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the 'new Range' function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs-semver: Regular expression denial of service",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Advanced Cluster Management for Kubernetes-2 and Red Hat Advanced Cluster Security-3 has been marked as Low severity because node-semver is a Dev dependency for those, used only during the build process, and not used in customer environments.\n\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM) the server-regexp dependency is protected by OAuth what is reducing impact by this flaw to Low.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-25883",
            },
            {
               category: "external",
               summary: "RHBZ#2216475",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2216475",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-25883",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-25883",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-25883",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-25883",
            },
            {
               category: "external",
               summary: "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
               url: "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
            },
            {
               category: "external",
               summary: "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795",
               url: "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795",
            },
         ],
         release_date: "2023-06-21T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:56:14+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5361",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "nodejs-semver: Regular expression denial of service",
      },
      {
         cve: "CVE-2023-30581",
         discovery_date: "2023-06-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2219824",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability has been discovered in Node.js,  where the use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs: mainModule.proto bypass experimental policy mechanism",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-30581",
            },
            {
               category: "external",
               summary: "RHBZ#2219824",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2219824",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-30581",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-30581",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-30581",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-30581",
            },
         ],
         release_date: "2023-06-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:56:14+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5361",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "nodejs: mainModule.proto bypass experimental policy mechanism",
      },
      {
         cve: "CVE-2023-30588",
         discovery_date: "2023-06-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2219838",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability has been identified in the Node.js, where an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs: process interuption due to invalid Public Key information in x509 certificates",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-30588",
            },
            {
               category: "external",
               summary: "RHBZ#2219838",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2219838",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-30588",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-30588",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-30588",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-30588",
            },
         ],
         release_date: "2023-06-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:56:14+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5361",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "nodejs: process interuption due to invalid Public Key information in x509 certificates",
      },
      {
         cve: "CVE-2023-30589",
         discovery_date: "2023-06-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2219841",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability has been identified in the Node.js, where llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs: HTTP Request Smuggling via Empty headers separated by CR",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-30589",
            },
            {
               category: "external",
               summary: "RHBZ#2219841",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2219841",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-30589",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-30589",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-30589",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-30589",
            },
         ],
         release_date: "2023-06-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:56:14+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5361",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "nodejs: HTTP Request Smuggling via Empty headers separated by CR",
      },
      {
         cve: "CVE-2023-30590",
         discovery_date: "2023-06-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2219842",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability has been identified in the Node.js, where a generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs: DiffieHellman do not generate keys after setting a private key",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-30590",
            },
            {
               category: "external",
               summary: "RHBZ#2219842",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2219842",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-30590",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-30590",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-30590",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-30590",
            },
         ],
         release_date: "2023-06-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:56:14+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5361",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "nodejs: DiffieHellman do not generate keys after setting a private key",
      },
      {
         cve: "CVE-2023-32002",
         cwe: {
            id: "CWE-1268",
            name: "Policy Privileges are not Assigned Consistently Between Control and Data Agents",
         },
         discovery_date: "2023-08-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2230948",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in NodeJS. This security issue occurs as the use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs: Permissions policies can be bypassed via Module._load",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This CVE marked as important as the permissions policies can be bypassed using via Module._load() functionality.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-32002",
            },
            {
               category: "external",
               summary: "RHBZ#2230948",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230948",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-32002",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-32002",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-32002",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-32002",
            },
            {
               category: "external",
               summary: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002",
               url: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002",
            },
         ],
         release_date: "2023-08-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:56:14+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5361",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "nodejs: Permissions policies can be bypassed via Module._load",
      },
      {
         cve: "CVE-2023-32006",
         cwe: {
            id: "CWE-213",
            name: "Exposure of Sensitive Information Due to Incompatible Policies",
         },
         discovery_date: "2023-08-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2230955",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in NodeJS. This security issue occurs as the use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-32006",
            },
            {
               category: "external",
               summary: "RHBZ#2230955",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230955",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-32006",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-32006",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-32006",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-32006",
            },
            {
               category: "external",
               summary: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006",
               url: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006",
            },
         ],
         release_date: "2023-08-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:56:14+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5361",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()",
      },
      {
         cve: "CVE-2023-32559",
         cwe: {
            id: "CWE-94",
            name: "Improper Control of Generation of Code ('Code Injection')",
         },
         discovery_date: "2023-08-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2230956",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') to run arbitrary code outside of the limits defined in a policy.json file.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs: Permissions policies can be bypassed via process.binding",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "It's important to emphasize that when this CVE was reported, the policy feature in Node.js was in its experimental stage.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
               "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-32559",
            },
            {
               category: "external",
               summary: "RHBZ#2230956",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230956",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-32559",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-32559",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-32559",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-32559",
            },
            {
               category: "external",
               summary: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-processbinding-mediumcve-2023-32559",
               url: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-processbinding-mediumcve-2023-32559",
            },
         ],
         release_date: "2023-08-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:56:14+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5361",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debuginfo-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-debugsource-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-devel-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-docs-1:16.20.2-2.module+el8.6.0+19897+9590a839.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-full-i18n-1:16.20.2-2.module+el8.6.0+19897+9590a839.x86_64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-nodemon-0:3.0.1-1.module+el8.6.0+19765+366b9144.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.noarch",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:nodejs-packaging-0:26-1.module+el8.6.0+19856+c0c87259.src",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.aarch64",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.ppc64le",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.s390x",
                  "AppStream-8.6.0.Z.EUS:nodejs:16:8060020230906023909:ad008a3a:npm-1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "nodejs: Permissions policies can be bypassed via process.binding",
      },
   ],
}

cve-2023-32002

Vulnerability from cvelistv5

Published

2023-08-21 16:52

Modified

2025-02-13 16:50

Severity ?

Summary

The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

References

▼	URL	Tags
	https://hackerone.com/reports/1960870
	https://security.netapp.com/advisory/ntap-20230915-0009/

Impacted products

	Vendor	Product	Version
	Node.js	Node.js	Version: 20.5.0 ≤ 20.5.0 Version: 18.17.0 ≤ 18.17.0 Version: 16.20.1 ≤ 16.20.1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:03:28.656Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/1960870",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20230915-0009/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "nodejs",
                  vendor: "nodejs",
                  versions: [
                     {
                        lessThanOrEqual: "16.20.1",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                     {
                        lessThanOrEqual: "18.17.0",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                     {
                        lessThanOrEqual: "20.5.0",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-32002",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-11T00:00:00+00:00",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-288",
                        description: "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T04:55:46.694Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Node.js",
               vendor: "Node.js",
               versions: [
                  {
                     lessThanOrEqual: "20.5.0",
                     status: "affected",
                     version: "20.5.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "18.17.0",
                     status: "affected",
                     version: "18.17.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "16.20.1",
                     status: "affected",
                     version: "16.20.1",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-09-15T13:06:27.101Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://hackerone.com/reports/1960870",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20230915-0009/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-32002",
      datePublished: "2023-08-21T16:52:42.147Z",
      dateReserved: "2023-05-01T01:00:12.220Z",
      dateUpdated: "2025-02-13T16:50:16.650Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-30581

Vulnerability from cvelistv5

Published

2023-11-22 23:28

Modified

2024-08-02 14:28

Severity ?

Summary

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

References

▼	URL	Tags
	https://nodejs.org/en/blog/vulnerability/june-2023-security-releases

Impacted products

	Vendor	Product	Version
	Node.js	Node.js	Version: 16.20.1 ≤ Version: 18.16.1 ≤ Version: 20.3.1 ≤

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T14:28:51.907Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Node.js",
               vendor: "Node.js",
               versions: [
                  {
                     lessThan: "16.20.1",
                     status: "affected",
                     version: "16.20.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "18.16.1",
                     status: "affected",
                     version: "18.16.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "20.3.1",
                     status: "affected",
                     version: "20.3.1",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-11-22T23:28:30.768Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-30581",
      datePublished: "2023-11-22T23:28:30.768Z",
      dateReserved: "2023-04-13T01:00:12.085Z",
      dateUpdated: "2024-08-02T14:28:51.907Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-30590

Vulnerability from cvelistv5

Published

2023-11-28 19:15

Modified

2025-02-13 16:49

Severity ?

Summary

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.

References

▼	URL	Tags
	https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
	https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html

Impacted products

	Vendor	Product	Version
	Node.js	Node.js	Version: 16.20.1 ≤ Version: 18.16.1 ≤ Version: 20.3.1 ≤

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T14:28:51.940Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Node.js",
               vendor: "Node.js",
               versions: [
                  {
                     lessThan: "16.20.1",
                     status: "affected",
                     version: "16.20.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "18.16.1",
                     status: "affected",
                     version: "18.16.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "20.3.1",
                     status: "affected",
                     version: "20.3.1",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: \"Generates private and public Diffie-Hellman key values\".\n\nThe documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-03-27T02:06:18.446Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases",
            },
            {
               url: "https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-30590",
      datePublished: "2023-11-28T19:15:19.447Z",
      dateReserved: "2023-04-13T01:00:12.086Z",
      dateUpdated: "2025-02-13T16:49:32.654Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-30589

Vulnerability from cvelistv5

Published

2023-06-30 23:39

Modified

2025-02-13 16:49

Severity ?

Summary

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

References

▼	URL	Tags
	https://hackerone.com/reports/2001873
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/
	https://security.netapp.com/advisory/ntap-20230803-0009/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF/
	https://security.netapp.com/advisory/ntap-20240621-0006/

Impacted products

	Vendor	Product	Version
	Node.js	https://github.com/nodejs/node	Version: v20.3.1 ≤ Version: v18.16.1 ≤ Version: v16.20.1 ≤

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T14:28:51.669Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/2001873",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20230803-0009/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240621-0006/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "https://github.com/nodejs/node",
               vendor: "Node.js",
               versions: [
                  {
                     lessThan: "v20.3.1",
                     status: "affected",
                     version: "v20.3.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "v18.16.1",
                     status: "affected",
                     version: "v18.16.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "v16.20.1",
                     status: "affected",
                     version: "v16.20.1",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).\r\n\r\nThe CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-06-21T19:07:31.441Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://hackerone.com/reports/2001873",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20230803-0009/",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE/",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20240621-0006/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-30589",
      datePublished: "2023-06-30T23:39:59.161Z",
      dateReserved: "2023-04-13T01:00:12.086Z",
      dateUpdated: "2025-02-13T16:49:32.084Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-30588

Vulnerability from cvelistv5

Published

2023-11-28 19:15

Modified

2025-02-13 16:49

Severity ?

Summary

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

References

▼	URL	Tags
	https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
	https://security.netapp.com/advisory/ntap-20240621-0006/

Impacted products

	Vendor	Product	Version
	Node.js	Node.js	Version: 16.20.1 ≤ Version: 18.16.1 ≤ Version: 20.3.1 ≤

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T14:28:51.603Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240621-0006/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Node.js",
               vendor: "Node.js",
               versions: [
                  {
                     lessThan: "16.20.1",
                     status: "affected",
                     version: "16.20.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "18.16.1",
                     status: "affected",
                     version: "18.16.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "20.3.1",
                     status: "affected",
                     version: "20.3.1",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-06-21T19:07:53.758Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20240621-0006/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-30588",
      datePublished: "2023-11-28T19:15:19.430Z",
      dateReserved: "2023-04-13T01:00:12.086Z",
      dateUpdated: "2025-02-13T16:49:31.496Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-32006

Vulnerability from cvelistv5

Published

2023-08-15 15:10

Modified

2025-02-13 16:50

Severity ?

Summary

The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

References

▼	URL	Tags
	https://hackerone.com/reports/2043807
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/
	https://security.netapp.com/advisory/ntap-20230915-0009/

Impacted products

	Vendor	Product	Version
	Node.js	Node.js	Version: 20.5.0 ≤ 20.5.0 Version: 18.17.0 ≤ 18.17.0 Version: 16.20.1 ≤ 16.20.1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:03:28.787Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/2043807",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20230915-0009/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-32006",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-08T20:20:48.763469Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-08T20:21:00.388Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Node.js",
               vendor: "Node.js",
               versions: [
                  {
                     lessThanOrEqual: "20.5.0",
                     status: "affected",
                     version: "20.5.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "18.17.0",
                     status: "affected",
                     version: "18.17.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "16.20.1",
                     status: "affected",
                     version: "16.20.1",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-09-15T13:06:28.688Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://hackerone.com/reports/2043807",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20230915-0009/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-32006",
      datePublished: "2023-08-15T15:10:09.447Z",
      dateReserved: "2023-05-01T01:00:12.220Z",
      dateUpdated: "2025-02-13T16:50:18.952Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-25883

Vulnerability from cvelistv5

Published

2023-06-21 05:00

Modified

2024-12-06 16:55

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P

Summary

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

References

▼	URL	Tags
	https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
	https://github.com/npm/node-semver/blob/main/internal/re.js%23L160
	https://github.com/npm/node-semver/blob/main/internal/re.js%23L138
	https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
	https://github.com/npm/node-semver/pull/564
	https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441

Impacted products

	Vendor	Product	Version
	n/a	semver	Version: 0 ≤

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-10-25T13:07:28.542Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/node-semver/blob/main/internal/re.js%23L160",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/node-semver/blob/main/internal/re.js%23L138",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/node-semver/pull/564",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441",
               },
               {
                  url: "https://security.netapp.com/advisory/ntap-20241025-0004/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-25883",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-12-06T16:54:52.064322Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-1333",
                        description: "CWE-1333 Inefficient Regular Expression Complexity",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-12-06T16:55:09.228Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "semver",
               vendor: "n/a",
               versions: [
                  {
                     lessThan: "7.5.2",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Alessio Della Libera - Snyk Research Team",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\r\r\r",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-1333",
                     description: "Regular Expression Denial of Service (ReDoS)",
                     lang: "en",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-06-21T05:00:03.352Z",
            orgId: "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
            shortName: "snyk",
         },
         references: [
            {
               url: "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795",
            },
            {
               url: "https://github.com/npm/node-semver/blob/main/internal/re.js%23L160",
            },
            {
               url: "https://github.com/npm/node-semver/blob/main/internal/re.js%23L138",
            },
            {
               url: "https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104",
            },
            {
               url: "https://github.com/npm/node-semver/pull/564",
            },
            {
               url: "https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
      assignerShortName: "snyk",
      cveId: "CVE-2022-25883",
      datePublished: "2023-06-21T05:00:03.352Z",
      dateReserved: "2022-02-24T11:58:25.192Z",
      dateUpdated: "2024-12-06T16:55:09.228Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-32559

Vulnerability from cvelistv5

Published

2023-08-24 01:23

Modified

2025-02-13 16:54

Severity ?

Summary

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

References

▼	URL	Tags
	https://hackerone.com/reports/1946470
	https://security.netapp.com/advisory/ntap-20231006-0006/

Impacted products

	Vendor	Product	Version
	Node.js	Node.js	Version: 20.5.0 ≤ 20.5.0 Version: 18.17.0 ≤ 18.17.0 Version: 16.20.1 ≤ 16.20.1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:18:37.607Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/1946470",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20231006-0006/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "nodejs",
                  vendor: "nodejs",
                  versions: [
                     {
                        lessThan: "16.20.1",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                     {
                        lessThan: "18.17.0",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                     {
                        lessThan: "20.5.0",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-32559",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-03T13:34:58.374555Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-269",
                        description: "CWE-269 Improper Privilege Management",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-03T13:38:25.120Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Node.js",
               vendor: "Node.js",
               versions: [
                  {
                     lessThanOrEqual: "20.5.0",
                     status: "affected",
                     version: "20.5.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "18.17.0",
                     status: "affected",
                     version: "18.17.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "16.20.1",
                     status: "affected",
                     version: "16.20.1",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-06T14:06:39.811Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://hackerone.com/reports/1946470",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20231006-0006/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-32559",
      datePublished: "2023-08-24T01:23:29.038Z",
      dateReserved: "2023-05-10T01:00:12.523Z",
      dateUpdated: "2025-02-13T16:54:48.738Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_redhat

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature